Reproduced Exploit
OUSD total supply can fall below user balances — broken rebasing invariant
An opted-out account keeps its balance while changeSupply lowers the aggregate total. The common balanceOf(x) <= totalSupply() invariant is immediately false.
Loss
ERC-20 supply accounting becomes inconsistent and can understate claims
Chain
Ethereum
Category
logic
Date
Jan 2021
Source
AuditVault
EVM Playground
Source-level debugger — step opcodes and Solidity in sync
The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.
Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 18214-ousd-total-supply-can-be-arbitrary-even-smaller-than-user-ba. Standalone Foundry PoC and full write-up: 18214-ousd-total-supply-can-be-arbitrary-even-smaller-than-user-ba_exp in the
evm-hack-registrymirror.
Vulnerability classes: vuln/logic/wrong-condition · vuln/arithmetic/rounding
Reproduction: self-contained synthetic Foundry reduction; see output.txt.
Key info#
| Field | Value |
|---|---|
| Loss | ERC-20 supply accounting becomes inconsistent and can understate claims |
| Vulnerable contract | OUSD.changeSupply / rebase opt-out accounting |
| Attacker EOA | 0x1111111111111111111111111111111111111111 |
| Attack contract | OUSD via Exploit |
| Attack tx | Exploit.run() |
| Chain / block / date | Ethereum model · block 0 · 2021-01 |
| Compiler | solc 0.8.24 (synthetic) |
| Bug class | Supply update does not reconcile non-rebasing balances |
TL;DR#
An opted-out account keeps its balance while changeSupply lowers the aggregate total. The common balanceOf(x) <= totalSupply() invariant is immediately false.
Background#
OUSD exposes non-rebasing accounts. The report warns that global supply changes must account for these fixed balances; this PoC isolates the invariant break.
The vulnerable code#
totalSupply = newSupply; // @> account balances are not reconciled
Root cause#
The supply setter permits an arbitrary lower value without checking the sum of opted-out balances.
Preconditions#
- An account has opted out of rebasing.
- A privileged supply change can lower total supply.
Attack walkthrough#
Exploitmints a 100-token fixed balance and opts out.changeSupply(1)lowers global supply.- The
Proofevent at output.txt:380 shows balance100versus supply1.
Diagrams#
Remediation#
Preserve the supply/balance invariant during rebases, explicitly account for non-rebasing balances, and reject any target supply below outstanding balances.
How to reproduce#
cd evm-hack-registry/18214-ousd-total-supply-can-be-arbitrary-even-smaller-than-user-ba_exp
forge test -vvvvv
Sources#
Reference: https://github.com/trailofbits/publications/blob/master/reviews/OriginDollar.pdf
Sources & further analysis#
Reproductions & code
- Standalone PoC + full trace: 18214-ousd-total-supply-can-be-arbitrary-even-smaller-than-user-ba_exp (evm-hack-registry mirror).
- AuditVault finding: 18214-ousd-total-supply-can-be-arbitrary-even-smaller-than-user-ba.
Alerts & third-party analyses
These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.