Maia DAO — Adversary can poison depositNonce via retrieveDeposit and lock user deposits

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 26042-h-08-due-to-inadequate-checks-an-adversary-can-call-branchbr. Standalone Foundry PoC and full write-up: 26042-h-08-due-to-inadequate-checks-an-adversary-can-call-branchbr_exp in the evm-hack-registry mirror.

Vulnerability classes: see taxonomy below

Reproduction: a self-contained Foundry PoC that compiles & runs in an isolated project with only forge-std — no fork, no RPC, no anvil_state. Full trace: output.txt. PoC: test/26042-h-08-due-to-inadequate-checks-an-adversary-can-call-branchbr_exp.sol.

Key info#

This is an audit finding, not a historical on-chain incident.

TL;DR#

1. Attacker calls retrieveDeposit(60) with no ownership check.\n2. Root marks nonce 60 executed.\n3. User deposit with nonce 60 is rejected on root; tokens locked on branch.

Diagrams#

Impact#

Permissionless retrieveDeposit marks future nonce executed; user deposit of 1000 DEP locked on branch

Sources#

• AuditVault finding
• Code4rena report
• Reduced synthetic: test/26042-h-08-due-to-inadequate-checks-an-adversary-can-call-branchbr.sol (C2 local-deploy)

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 26042-h-08-due-to-inadequate-checks-an-adversary-can-call-branchbr_exp (evm-hack-registry mirror).
• AuditVault finding: 26042-h-08-due-to-inadequate-checks-an-adversary-can-call-branchbr.

Alerts & third-party analyses

• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.