The Sandbox SAND OFT — `approveAndCall` hijacks LayerZero delegate and mints unbacked SAND

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2026-08-SandboxOFT_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/SandboxOFT_exp.sol.

Vulnerability classes: vuln/access-control/missing-auth · vuln/bridge/message-spoofing · vuln/input-validation/missing

Reproduction: the PoC compiles & runs in an isolated Foundry project at this project folder. Full verbose trace: output.txt. Source test: test/SandboxOFT_exp.sol. Sibling playground of the same campaign: 2026-08-UnknownHack (this folder is the typed reconstruction of one 10M-SAND mint tx).

Key info#

TL;DR#

OFTSand.approveAndCall(target, amount, data) does target.call{value: msg.value}(data) with msg.sender == the token. Its only guard is doFirstParamEqualsAddress(data, _msgSender()) — the first 32-byte word of data must equal the caller. That stops spending someone else's approval. It does not stop calling any function on any contract as the token.

The token is the LayerZero OApp. Attacker:

1. approveAndCall(Endpoint, 0, setDelegate(attacker)) — first param is the attacker, guard passes, Endpoint records the attacker as SAND's delegate (normally onlyOwner).
2. As delegate, Endpoint.setConfig(OFTSand, ReceiveUln302, UlnConfig{requiredDVNs:[attacker]}).
3. As that DVN, verify + commitVerification a forged inbound packet (srcEid 30101 = Ethereum). Peer check passes because SAND OFT is deployed at the same address on Ethereum and Base.
4. Endpoint.lzReceive → OFTSand._credit → bare _mint. 10,000,000 SAND (amountSD 1e13 * decimalConversionRate 1e12).

No key/admin compromise. Every step is a public call.

Background#

LayerZero OFTs credit the destination token when a verified inbound packet arrives. Security is the ULN config: required DVNs must attest the packet. setDelegate / setConfig are supposed to be owner-only on the OApp.

SAND OFT added an ERC677 approveAndCall helper so dapps can approve-and-hook in one tx. Combined with "the token is the OApp", that helper is a confused-deputy primitive against EndpointV2.

The vulnerable code#

function approveAndCall(address target, uint256 amount, bytes calldata data)
    external payable returns (bytes memory)
{
    // ... optional approve ...
    require(BytesUtil.doFirstParamEqualsAddress(data, _msgSender()), "first param != sender");
    (bool ok, bytes memory ret) = target.call{value: msg.value}(data); // msg.sender == token
    require(ok);
    return ret;
}

setDelegate(address)'s first ABI word is an address. Passing setDelegate(attacker) satisfies the guard and runs as the OApp.

OFTSand._credit is _mint(to, amountLD) with no backing check — correct if the packet was DVN-attested. After step 2, the DVN is the attacker.

Root cause#

1. Unrestricted target/selector on a helper that executes as the token.
2. OApp identity = token identity, so a CALL-as-token is a CALL-as-OApp.
3. Same address on two chains makes a forged Ethereum→Base packet pass the peer check (sender == address(this)).
4. _credit trusts the packet once the Endpoint delivers it.

Preconditions#

• Attacker can CREATE a contract whose address they pass as setDelegate's first arg (so the guard matches msg.sender of approveAndCall).
• Receive ULN allows setConfig by the OApp delegate.
• Peer[30101] is the OFT's own address.

Attack walkthrough#

Exact calldata from test/SandboxOFT_exp.sol (prank as attack contract, tx.origin = EOA):

SAND balance of attacker before: 70000000
SAND balance of attacker after : 80000000
Unbacked SAND minted            : 10000000
[PASS] testExploit()

(The EOA already held 70M from earlier campaign txs; this PoC is one mint.)

Diagrams#

Remediation#

1. Remove approveAndCall, or whitelist (target, selector). Never allow a generic CALL-as-token into the bridging stack.
2. Keep setDelegate / setConfig strictly onlyOwner on the OApp; do not let the token's msg.sender be spoofable via helpers.
3. Require independent DVNs; reject a config with a single untrusted required DVN.
4. Don't treat same-address deployment as a peer proof without packet/payload authentication beyond DVN attestations the OApp itself can rewrite.

How to reproduce#

_shared/run_poc.sh 2026-08-SandboxOFT_exp --mt testExploit -vvvvv

Fork is Base (127.0.0.1:8548). Expected: [PASS] testExploit() with 10,000,000 SAND minted.

Reference: https://x.com/GoPlusSecurity/status/2091350029617500439

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2026-08-SandboxOFT_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: SandboxOFT_exp.sol.
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• DeFiHackLabs incident explorer: search "The Sandbox SAND OFT".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.