Reproduced Exploit

OUSD total supply can fall below user balances — broken rebasing invariant

An opted-out account keeps its balance while changeSupply lowers the aggregate total. The common balanceOf(x) <= totalSupply() invariant is immediately false.

Jan 2021Ethereumlogic2 min read

Loss

ERC-20 supply accounting becomes inconsistent and can understate claims

Chain

Ethereum

Category

logic

Date

Jan 2021

Source

AuditVault

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 18214-ousd-total-supply-can-be-arbitrary-even-smaller-than-user-ba. Standalone Foundry PoC and full write-up: 18214-ousd-total-supply-can-be-arbitrary-even-smaller-than-user-ba_exp in the evm-hack-registry mirror.


Vulnerability classes: vuln/logic/wrong-condition · vuln/arithmetic/rounding

Reproduction: self-contained synthetic Foundry reduction; see output.txt.

Key info#

FieldValue
LossERC-20 supply accounting becomes inconsistent and can understate claims
Vulnerable contractOUSD.changeSupply / rebase opt-out accounting
Attacker EOA0x1111111111111111111111111111111111111111
Attack contractOUSD via Exploit
Attack txExploit.run()
Chain / block / dateEthereum model · block 0 · 2021-01
Compilersolc 0.8.24 (synthetic)
Bug classSupply update does not reconcile non-rebasing balances

TL;DR#

An opted-out account keeps its balance while changeSupply lowers the aggregate total. The common balanceOf(x) <= totalSupply() invariant is immediately false.

Background#

OUSD exposes non-rebasing accounts. The report warns that global supply changes must account for these fixed balances; this PoC isolates the invariant break.

The vulnerable code#

SOLIDITY
totalSupply = newSupply; // @> account balances are not reconciled

Root cause#

The supply setter permits an arbitrary lower value without checking the sum of opted-out balances.

Preconditions#

  • An account has opted out of rebasing.
  • A privileged supply change can lower total supply.

Attack walkthrough#

  1. Exploit mints a 100-token fixed balance and opts out.
  2. changeSupply(1) lowers global supply.
  3. The Proof event at output.txt:380 shows balance 100 versus supply 1.

Diagrams#

flowchart TD A[Opted-out balance is 100] --> B[change supply to one] B --> C[Balance remains 100] C --> D[totalSupply = 1]

Remediation#

Preserve the supply/balance invariant during rebases, explicitly account for non-rebasing balances, and reject any target supply below outstanding balances.

How to reproduce#

BASH
cd evm-hack-registry/18214-ousd-total-supply-can-be-arbitrary-even-smaller-than-user-ba_exp
forge test -vvvvv

Sources#

Reference: https://github.com/trailofbits/publications/blob/master/reviews/OriginDollar.pdf


Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.