Reddio RedSonic Vault — permissionless `registerErc20(stETH)` double-counts one balance

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2026-09-Reddio_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/Reddio_exp.sol.

Vulnerability classes: vuln/logic/price-calculation · vuln/access-control/missing-auth · vuln/logic/missing-check

Reproduction: the PoC compiles & runs in an isolated Foundry project at this project folder. Full verbose trace: output.txt. Source test: test/Reddio_exp.sol.

Key info#

TL;DR#

RedSonic Vault (EIP-2535 diamond) prices rsvETH from getTotalAssetBalance, which for the Lido leg is IERC20(stETH).balanceOf(vault) — no per-share-class accounting. registerErc20(address) is permissionless (attacker contract, not owner, calls it in the trace).

Registering stETH creates rsvstETH backed by that same raw balance. Flow in one Balancer flash of 1,139.6159 WETH:

1. Unwrap; registerErc20(stETH).
2. depositEth{value: 1,130.2592 ETH} — buy ~99% of rsvETH at the pre-inflation price.
3. Lido submit ~9.3566 ETH → stETH; depositErc20(stETH, ~9.3366) — inflates rsvETH's share price without minting rsvETH.
4. manualWithdraw(rsvETH, all) — redeem at the inflated rate (~1,139.51 ETH).
5. manualWithdraw(rsvstETH, all) — recover the deposited stETH.
6. Curve stETH→ETH; repay Balancer; leftover ~9.25 ETH to the EOA.

Deposit/redeem/register facet 0x92ecC5DE… is unverified; names are 4-byte-directory matches for selectors in the trace (registerErc20=0xa4a3c9ef, depositEth=0x439370b1, depositErc20=0x6548b40d, manualWithdraw=0x735fd189).

Background#

A diamond vault with an ETH share class (rsvETH) that is internally backed in part by Lido stETH. Pricing getters on the verified InvestmentManagerFacet:

• getTotalAssetBalance(asset) — sum of provider legs + getRemainingBalance(asset).
• getRemainingBalance for a non-native asset is IERC20(asset).balanceOf(vault).

Nothing tracks "this many stETH wei belong to the ETH class vs the stETH class."

The vulnerable code#

Verified pricing (InvestmentManagerFacet):

function getRemainingBalance(address asset) public view returns (uint256) {
    if (asset == address(0) /* native */) { /* ... */ }
    return IERC20(asset).balanceOf(address(this)); // RAW vault balance
}

Permissionless registration (unverified facet; selector 0xa4a3c9ef):

function registerErc20(address erc20) external; // no onlyOwner in the trace

Once stETH is a second tracked asset, depositErc20(stETH, x) credits rsvstETH and increases the raw stETH balance the ETH class already prices off.

Root cause#

One inventory, two liabilities. Permissionless listing of an asset that the ETH class already counts as backing is an inflation vector: deposit under class B, redeem class A at the new NAV, redeem class B to unwind the deposit.

Preconditions#

• vTokenFromErc20(stETH) == 0 (or the attacker can still deposit into the existing class — the PoC registers if missing).
• Enough ETH-class TVL that owning ~99% of rsvETH captures the inflated NAV.
• Balancer WETH flash (~1,139.6 WETH) + Curve stETH/ETH exit.

Attack walkthrough#

Constants from the trace (test/Reddio_exp.sol):

attacker net gain (ETH): 9.253090281137114614
[PASS] testExploit()

(On-chain the EOA also paid gas; the harness does not charge the pranked EOA.)

Diagrams#

Remediation#

1. registerErc20 must be onlyOwner (or a governed listing with an asset-that-is-already-backing-ETH-class check).
2. Per-share-class accounting. stETH held for the ETH class must not sit in the same balanceOf(vault) bucket that a second ERC-20 class prices off — use a per-asset internal ledger.
3. Haircut / virtual offset so a donation or same-asset deposit cannot move rsvETH NAV by more than X% in one block.
4. Snapshot total assets before listing a new ERC-20.

How to reproduce#

_shared/run_poc.sh 2026-09-Reddio_exp --mt testExploit -vvvvv

Expected: [PASS] testExploit() with ~9.25 ETH gain.

Reference: https://x.com/exvulsec/status/2096277307757572517

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2026-09-Reddio_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: Reddio_exp.sol.
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• DeFiHackLabs incident explorer: search "Reddio RedSonic Vault".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.