Audius unresponsive provider locks 1000 of delegator stake

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 11323-h12-unresponsive-service-provider-locks-delegator-stake-open. Standalone Foundry PoC and full write-up: 11323-h12-unresponsive-service-provider-locks-delegator-stake-open_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/dos/frozen-funds · vuln/logic/wrong-condition

Key info#


Protocol	Audius
Finding	OpenZeppelin H12, AuditVault 11323
Vulnerable code	`DelegateManager.undelegateStake`
Harm	1000 AUDIO cannot be withdrawn
Chain	local synthetic

TL;DR#

undelegateStake reverts while claimPending is true for the service provider. claimPending stays true once a round is funded and the provider has not claimed, and only the provider can call claimRewards. After the undelegate lockup (block 50, replayed at block 100) the delegator still cannot exit. 1000 AUDIO remains in the manager. Writing the provider's last-claim block forward, which is what letting anyone claim does, makes the same undelegateStake return the 1000.

The vulnerable code#

SOLIDITY

require(undelegateRequests[delegator].lockupExpiryBlock <= block.number, "Lockup must be expired");
// @> VULN: an unresponsive SP never claims, so _claimPending stays true and this require reverts
require(!_claimPending(undelegateRequests[delegator].serviceProvider), "Undelegate not permitted for SP pending claim");

SOLIDITY

function claimPending(address _sp) external view returns (bool pending) {
    uint256 lastClaimedForSP = staking.lastClaimedFor(_sp);
    (,,, uint256 numEndpoints,,) = spFactory.getServiceProviderDetails(_sp);
    return (lastClaimedForSP < fundBlock && numEndpoints > 0);
}

Root cause#

The exit is gated on a claim that only the service provider is allowed to submit. If that account never calls claimRewards, lastClaimedFor stays behind fundBlock and every delegator of that provider is stuck.

Preconditions#

The provider has at least one endpoint, a funding round exists (fundBlock = 1), and lastClaimedFor is 0. The delegator's lockup expiry is block 50. The replay uses a single block, number 100, which is already past that expiry. No timestamp warp is required.

Attack walkthrough#

The delegator deposits 1000 AUDIO. The request expires at block 50 and names the provider.
undelegateStake sees 50 <= 100, so the lockup is over.
claimPending is true.
The require reverts. The 1000 stays in the manager and the delegator balance is 0.

Diagrams#

flowchart TD A["Delegator deposits 1000"] --> B["Lockup block 50 is already behind block 100"] B --> C["Provider never calls claimRewards"] C --> D["claimPending stays true"] D --> E["VULN: undelegateStake reverts"] E --> F["1000 AUDIO cannot be withdrawn"]

Impact#

1000 AUDIO is locked. The delegator cannot withdraw it while the provider is unresponsive. The control sets lastClaimedFor to the funded round and undelegateStake returns the 1000 to the delegator.

Remediation#

Let any account call claimRewards for a service provider, so a missed claim cannot freeze delegator exits.

How to reproduce#

BASH

cd 11323-h12-unresponsive-service-provider-locks-delegator-stake-open_exp
forge test -vv

Sources#

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 11323-h12-unresponsive-service-provider-locks-delegator-stake-open_exp (evm-hack-registry mirror).
AuditVault finding: 11323-h12-unresponsive-service-provider-locks-delegator-stake-open.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync