DayContract / Polarx — Spot Manip + Rigid Principal Guarantee

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2026-03-DayContract_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/DayContract_exp.sol.

Vulnerability classes: vuln/oracle/price-manipulation · vuln/logic/missing-check

Reproduction: Foundry PoC in this project folder — ONLINE BSC archive fork. Verbose run: output.txt. Sources: sources/DayContract.sol, sources/SettlementVault.sol.

Key info#

TL;DR#

DayContract.deposit converts USDT → LP via Pancake spot reserves (no TWAP). withdraw always calls vault.settlePrincipal(user, fullPrincipal, 0), and the vault’s _ensureUSDTBalance redeems shared vault LP until it can pay that principal — regardless of the order’s own post-manipulation NAV.

Attacker flow (atomic):

1. Flash/deal ~2.04M USDT; deploy 38 registered helpers.
2. Two fair deposits of 1,000 USDT.
3. Buy ~2M USDT of PSTAR → spike spot.
4. 36 more 1,000 USDT deposits at inflated spot (sandwich meat + overvalued LP receipts).
5. Dump PSTAR → ~2.01M USDT back (manip profit from deposit-side buys/liquidity).
6. Withdraw all 38 orders → each gets full 1,000 USDT principal paid by draining shared LP.

PoC profit ~10,655 USDT (matches ExVul ~$10.6K).

Vulnerable code#

Spot LP mint (sources/DayContract.sol)#

function deposit(uint256 amount) external nonReentrant {
    // ...
    uint256 lpReceived = _convertToLP(amount); // spot reserves only
    // store order.principal = amount (USDT face value)
    vault.receiveLP(msg.sender, orderId, lpReceived);
    vault.increaseDeposit(msg.sender, amount);
}

Rigid principal (sources/DayContract.sol + vault)#

function withdraw(uint256 orderId) external nonReentrant {
    // ...
    vault.redeemLP(msg.sender, orderId); // may yield ≪ principal after dump
    // ...
    vault.settlePrincipal(msg.sender, returnAmount, 0); // returnAmount ≈ full principal
}

// SettlementVault
function settlePrincipal(...) external onlyAuthorized {
    _ensureUSDTBalance(principal); // redeems SHARED vault LP until balance ≥ principal
    usdt.transfer(user, returnAmount);
}

Attack flow#

PoC notes#

• ONLINE: BSC_RPC_URL=... forge test --match-contract DayContract_exp -vv --gas-limit 100000000
• Capital via deal (live: Moolah flash loan).
• Referral sponsor: live depositor 0xB08d…bF58.
• Offline anvil_state.json not shipped (large state; ONLINE only).

References#

• ExVul: https://x.com/exvulsec/status/2038606487581495329

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2026-03-DayContract_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: DayContract_exp.sol.
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• DeFiHackLabs incident explorer: search "DayContract / Polarx".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.