Reproduced Exploit
Yield V2 Witch `buy`/`payAll` accepted vaults that were not under auction
Chain
Other
Category
logic
Date
Jun 2021
Source
AuditVault
EVM Playground
Source-level debugger — step opcodes and Solidity in sync
The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.
Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 16980-witchs-buy-and-payall-functions-allow-users-to-buy-collatera. Standalone Foundry PoC and full write-up: 16980-yield-v2-witch-buy-payall-no-auction_exp in the
evm-hack-registrymirror.
Vulnerability classes: vuln/logic/missing-check · vuln/defi/liquidation
Reproduction: the test compiles and calls the historical Yield V2
Witchimplementation, with only the Cauldron/Ladle/Join protocol boundary mocked. Both vulnerable entry points transfer the complete collateral balance while their auction records are empty.
Root cause#
The audited Witch source at commit 698ff848^ (the parent of Yield Protocol's fix commit 698ff848, “draft: minimal fix for require on buy and payAll”) reads auctions[vaultId].start to compute the price but never checks that the timestamp is non-zero. A caller can therefore invoke liquidation-only functions for a normal vault. The fix adds require (auctions[vaultId].start > 0, "Vault not under auction") to both functions.
The exact historical contract is vendored at src/vault/Witch.sol. Its matching interface and utility sources are vendored under src/vault/interfaces-package and src/vault/utils-v2.
Reproduction#
The fixture creates a 1,000-unit collateral / 400-unit debt vault with no auction entry, seeds the real Witch's collateral Join, and calls the real payAll and buy functions. Because start is zero, the historical implementation evaluates the final auction price and exits all 1,000 collateral to the caller.
cd 16980-yield-v2-witch-buy-payall-no-auction_exp
forge test -vvv
Expected result: 2 passed. The assertions in test/16980-yield-v2-witch-buy-payall-no-auction_exp.sol verify that the caller receives 1,000 collateral and that the vault's collateral and debt balances are reduced to zero.
Sources#
Sources & further analysis#
Reproductions & code
- Standalone PoC + full trace: 16980-yield-v2-witch-buy-payall-no-auction_exp (evm-hack-registry mirror).
- AuditVault finding: 16980-witchs-buy-and-payall-functions-allow-users-to-buy-collatera.
- Upstream DeFiHackLabs PoC directory: src/test.
Alerts & third-party analyses
- DeFiHackLabs incident explorer: search "Yield V2 Witch
buy/payAllaccepted vaults that were not under auction". - Web3Sec X hacked database: search.
- Rekt leaderboard: search.
- Solodit incident search: search.
These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.