Reentrant `mintMultiple` callback — untrusted external call

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 18201-reentrancy-and-untrusted-contract-call-in-mintmultiple-diffi. Standalone Foundry PoC and full write-up: 18201-reentrancy-and-untrusted-contract-call-in-mintmultiple-diffi_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/reentrancy/single-function · vuln/dependency/unsafe-external-call

Reproduction: self-contained synthetic Foundry reduction; see output.txt.

Key info#

Field	Value
Loss	Reentrant asset callback can mutate vault accounting before mint completion
Vulnerable contract	`VaultCore.mintMultiple`
Attacker EOA	`0x1111111111111111111111111111111111111111`
Attack contract	`CallbackAsset` via `Exploit`
Attack tx	`Exploit.run()`
Chain / block / date	Ethereum model · block 0 · 2021-01
Compiler	`solc 0.8.24` (synthetic)
Bug class	Reentrancy through arbitrary `transferFrom`

TL;DR#

mintMultiple computes state and then calls every caller-supplied asset. A malicious token's transferFrom callback re-enters mint, proving that the no-guard ordering exposes temporary accounting state.

Background#

The Origin Dollar finding notes that unsupported assets are skipped in pricing but still called in the transfer loop. The reduction isolates that callback boundary and the missing nonReentrant guard.

The vulnerable code#

SOLIDITY

for (uint256 i; i < assets.length; ++i) {
    ICallbackAsset(assets[i]).transferFrom(msg.sender, address(this), amounts[i]);
}

Root cause#

The vault trusts an arbitrary token contract before settling the temporary imbalance and mint state. No reentrancy guard protects the externally callable minting family.

Preconditions#

The caller can supply an asset address.
The supplied asset implements a callback-capable transferFrom.

Attack walkthrough#

Exploit passes CallbackAsset to mintMultiple.
CallbackAsset.transferFrom calls VaultCore.mint while the outer call is active.
The Proof event at output.txt:380 shows rebaseCount = 1 from the callback.

Diagrams#

sequenceDiagram participant E as Exploit participant V as VaultCore participant T as Malicious asset E->>V: mintMultiple(assets) V->>T: transferFrom() T->>V: mint() re-entry V-->>E: outer call continues with corrupted ordering

Remediation#

Validate asset membership and non-zero amounts before any transfer, add nonReentrant to mint, mintMultiple, and redemption functions, and avoid arbitrary callbacks where possible.

How to reproduce#

BASH

cd evm-hack-registry/18201-reentrancy-and-untrusted-contract-call-in-mintmultiple-diffi_exp
forge test -vvvvv

Sources#

Reference: https://github.com/trailofbits/publications/blob/master/reviews/OriginDollar.pdf

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 18201-reentrancy-and-untrusted-contract-call-in-mintmultiple-diffi_exp (evm-hack-registry mirror).
AuditVault finding: 18201-reentrancy-and-untrusted-contract-call-in-mintmultiple-diffi.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync