Empty Set Reserve stale fixed-order drain — buying COMP below market from a hard-coded maker/taker price

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2025-07-EmptySetReserve_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/EmptySetReserve_exp.sol.

Vulnerability classes: vuln/oracle/price-manipulation · vuln/oracle/stale-price · vuln/logic/price-calculation Reproduction: the PoC compiles & runs in an isolated Foundry project at this project folder. Full verbose trace: output.txt. Vulnerable implementation source is verified on Etherscan and was fetched into sources/ReserveImpl_363aF3/ReserveImpl.sol.

Key info#

TL;DR#

Empty Set Reserve (ESR) is a legacy Empty Set Dollar derivative contract that, among other things, runs a small on-chain OTC "order book." Each order is just a (price, amount) pair that the owner writes once via registerOrder(). Anyone can then call swap(makerToken, takerToken, takerAmount) and the contract computes makerAmount = takerAmount / order.price and transfers its own inventory at that hard-coded rate — purely off storage, with no reference to any live price.

The COMP/ESS order had been left priced at a stale, favorable rate (price = 267_010_781_166_742_363_801_758, ~0.0111 ESS worth of COMP priced away from the real COMP market). On the attack block, COMP was worth materially more than that fixed rate implied, so the order was a standing below-market ask. The attacker took it: they flash-borrowed 10,000 USDC from Uniswap v4 PoolManager, converted it along a USDC→DSU→ESS and USDC→WETH→ESS path to assemble the ESS needed, then called RESERVE.swap(COMP, ESS, 11.1e24) and received 41,581.6e18 / 1e18 ≈ 41.58 COMP [output.txt:1775] [output.txt:1780] at the stale price. They immediately sold that COMP through Uniswap v2 for USDC + WETH, repaid the 10,000 USDC flash debt, and were left with ~0.4157 ETH of pure profit.

The local Foundry replay reproduces the exact economics: attacker ETH balance goes 0 → 0.416271181367327696 ETH [output.txt:1579] [output.txt:1579–1580] [output.txt:1957], the flash is repaid in full (USDC and DSU end at 0), and only an ESS residual of 204,890 ESS remains — the dust the attack deliberately didn't sell.

Background — what Empty Set Reserve does#

ESR is the reserve / staking / collateral spine of the Empty Set Dollar (ESD/ESS) ecosystem. Beyond minting/burning the ESDS stake token and managing debt, it exposes a lightweight swapper: an owner-registered list of token-pair "orders" that let the reserve sell inventory of one token (makerToken) in exchange for another (takerToken) at a fixed ratio.

An order is a struct with two fields:

struct Order {
    Decimal.D256 price;   // takerAmount per makerAmount, scaled by 1e18
    uint256 amount;       // makerToken inventory available; uint256(-1) = unlimited
}

registerOrder() is owner-gated and writes the price/amount verbatim into storage (_updateOrder). order() reads it back. swap() is public (notPaused, nonReentrant only) and executes against that stored price. There is no oracle integration, no TWAP, no time-decay, no rebalancing, and no freshness timestamp — the price is whatever the owner last set, and it stays valid until the owner sets another one. The only guard on size is the amount field (or uint256(-1) to disable the cap entirely).

This design is fine for a tightly-managed OTC desk that reprices in lockstep with the market. It is fatal when an order is left unattended while the market for the maker token moves — exactly what happened to the COMP/ESS order.

The vulnerable code#

From the verified implementation (sources/ReserveImpl_363aF3/ReserveImpl.sol:2163):

The public swap — fills at a storage-only price#

function swap(address makerToken, address takerToken, uint256 takerAmount) external nonReentrant notPaused {
    address dollar = registry().dollar();
    require(makerToken != dollar, "ReserveSwapper: unsupported token");
    require(takerToken != dollar, "ReserveSwapper: unsupported token");
    require(makerToken != takerToken, "ReserveSwapper: tokens equal");

    ReserveTypes.Order memory order = order(makerToken, takerToken);
    // makerAmount is derived SOLELY from the stored, owner-set `order.price`.
    // No oracle, no market reference, no staleness check, no slippage bound.
    uint256 makerAmount = Decimal.from(takerAmount).div(order.price, "ReserveSwapper: no order").asUint256();

    if (order.amount != uint256(-1))
        _decrementOrderAmount(makerToken, takerToken, makerAmount, "ReserveSwapper: insufficient amount");

    _transferFrom(takerToken, msg.sender, address(this), takerAmount);
    _transfer(makerToken, msg.sender, makerAmount);

    emit Swap(makerToken, takerToken, takerAmount, makerAmount);
}

The output amount is takerAmount / order.price — a single on-chain constant. The caller controls takerAmount (capped only by the amount inventory field), and the price is whatever the owner last wrote.

The order book and its setter#

function order(address makerToken, address takerToken) public view returns (ReserveTypes.Order memory) {
    return _state.orders[makerToken][takerToken];
}

// Owner-only, no freshness/peg logic:
function registerOrder(address makerToken, address takerToken, uint256 price, uint256 amount)
    external onlyOwner notPaused {
    _updateOrder(makerToken, takerToken, price, amount);
    emit OrderRegistered(makerToken, takerToken, price, amount);
}

The on-chain state at the fork block confirms the order was live and stale: order(COMP, ESS) returns price = 267_010_781_166_742_363_801_758 and amount = 41_581_642_538_295_042_665 (≈ 41.58 COMP of available inventory) — both asserted equal to the traced values in testExploit().

Root cause — why it was possible#

1. Price is a hard-coded storage value, not a market signal. swap() derives makerAmount purely from order.price, an owner-set constant. Nothing in the execution path references a live COMP price, a TWAP, an AMM spot, or an external oracle.
2. No freshness / peg / circuit-breaker. Order carries no timestamp, no last-updated, no max-deviation band, and no auto-pause when the market moves. An order set once stays executable at that exact rate indefinitely until the owner overwrites it.
3. swap() is permissionless. The only modifiers are nonReentrant and notPaused. Any externally-owned account or contract can fill any registered order for its full remaining amount. There is no allow-list of takers.
4. Asymmetric, atomically-composable settlement. The reserve hands over its makerToken (_transfer, a plain push) in the same transaction the caller pays takerToken (_transferFrom). Combined with flash liquidity (Uniswap v4 flash accounting here), an attacker can source the takerToken, fill the order, and dump the makerToken back into the same liquidity pools before repaying the flash — capturing the full stale-vs-market spread risk-free.
5. Order left unattended. Operationally, the COMP/ESS order was simply not repriced as COMP's market value drifted, leaving a standing below-market ask that the protocol's own inventory backed.

Preconditions#

• Permissionless — no privileged role, no allow-list, no governance action needed. Anyone can call swap().
• Flash-loan funded — the attack sources ~10,000 USDC of buying power from Uniswap v4 PoolManager's flash accounting, so the attacker needs essentially zero starting capital (only gas).
• Stale favorable order — a registered order whose stored price diverges from the live market by more than the swap-AMM slippage cost. The COMP/ESS order at block 22,988,103 met this.
• Reserve inventory — the reserve actually held the makerToken (COMP) to deliver; amount was non-zero.

Attack walkthrough (with on-chain numbers from the trace)#

All figures from output.txt.

Profit / loss accounting (per the local replay):

• Attacker ETH: 0 → 0.416271181367327696 ETH (asserted equal to LOCAL_REPLAY_PROFIT and greater than the traced 0.415688696263702812 ETH transfer — the tiny delta is the leftover-USDC→ETH conversion that the on-chain tx routed differently) [output.txt:1577] [output.txt:1935] [output.txt:1937].
• Attack-contract residuals after sweep: USDC 0, DSU 0, COMP 0, ESS 204,890,442,016,374,993,231,659 (≈ 0.2 ESS of dust — deliberately not worth selling) [output.txt:1933]–[output.txt:1953].
• Net: ~0.4157 ETH extracted, ~$1,509.78 at the time. Capital deployed by attacker: gas only.

Diagrams#

Remediation#

1. Don't run an OTC desk off a hard-coded price. Either remove the public swap() / order book entirely, or back every order with a real price source (Chainlink/Uniswap TWAP/redstone) and compute makerAmount from the live feed rather than order.price.
2. Add a freshness / staleness bound. Store lastUpdated on each Order and revert in swap() if block.timestamp - lastUpdated > MAX_AGE (e.g. 1 hour). Force the owner to actively re-affirm prices.
3. Add a max-deviation circuit breaker. Before filling, compare the stored order.price to a reference market price; revert if they diverge by more than a configurable band (e.g. 2%). This kills the exploit even if the order goes stale.
4. Cap order size and re-rate per fill. Bound takerAmount to a small fraction of available liquidity and/or apply time-weighted decay so a single call can't drain the whole inventory.
5. Never allow uint256(-1) unlimited-amount orders on a public swapper. Treat amount as a hard, monitored cap and alert on it.
6. Operational: monitor registered orders against market. Off-chain keepers should pause/replace any order whose stored price drifts from the market beyond tolerance.

How to reproduce#

The PoC runs fully OFFLINE via the shared anvil harness from the committed anvil_state.json — no RPC needed. Run, from the registry root:

_shared/run_poc.sh 2025-07-EmptySetReserve_exp -vvvvv

• Chain / fork block: Ethereum mainnet, fork block 22,988,103.
• Expected result: [PASS] with the attacker ETH balance moving 0.000000000000000000 → 0.416271181367327696 [output.txt:1579] [output.txt:1957], flash fully repaid (USDC/DSU end at 0), COMP end at 0, ESS residual 204890442016374993231659.
• The local run confirms the exact on-chain economics: LOCAL_REPLAY_PROFIT (0.41627… ETH) > TRACE_ETH_TRANSFER (0.41568… ETH), asserted in the test [output.txt:1935] [output.txt:1937].

Reference: Telegram alert (defimon_alerts/1532).

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2025-07-EmptySetReserve_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: EmptySetReserve_exp.sol.
• Attack transaction: view on explorer.

Alerts & third-party analyses

• DeFiHackLabs incident explorer: search "Empty Set Reserve stale fixed-order drain".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.