Reproduced Exploit
Maia DAO — checkParams does not check token is underlying of hToken
1. checkParams requires underlying exists and hToken is local, not that they pair.\n2. Attacker deposits USDC with hToken=hEther.\n3. Root mints 10 global hEther for 10 USDC.
Chain
Other
Category
untagged
Date
May 2023
Source
AuditVault
EVM Playground
Source-level debugger — step opcodes and Solidity in sync
The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.
Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 26043-h-09-rootbridgeagent-checkparamslibcheckparams-does-not-chec. Standalone Foundry PoC and full write-up: 26043-h-09-rootbridgeagent-checkparamslibcheckparams-does-not-chec_exp in the
evm-hack-registrymirror.
Vulnerability classes: see taxonomy below
Reproduction: a self-contained Foundry PoC that compiles & runs in an isolated project with only
forge-std— no fork, no RPC, noanvil_state. Full trace: output.txt. PoC: test/26043-h-09-rootbridgeagent-checkparamslibcheckparams-does-not-chec_exp.sol.
Key info#
| Impact | HIGH — Deposit 10 USDC, mint 10 global hEther (mismatched pair) — fund theft |
| Protocol | Maia DAO |
| Finding | Code4rena · reporter xuwinnie |
| Report | https://code4rena.com/reports/2023-05-maia |
| Source | AuditVault |
| Status | Audit finding — reproduced as a standalone local PoC. |
| Compiler | ^0.8.24 (PoC) |
This is an audit finding, not a historical on-chain incident.
TL;DR#
- checkParams requires underlying exists and hToken is local, not that they pair.\n2. Attacker deposits USDC with hToken=hEther.\n3. Root mints 10 global hEther for 10 USDC.
Diagrams#
Impact#
Deposit 10 USDC, mint 10 global hEther (mismatched pair) — fund theft
Sources#
- AuditVault finding
- Code4rena report
- Reduced synthetic:
test/26043-h-09-rootbridgeagent-checkparamslibcheckparams-does-not-chec.sol(C2 local-deploy)
Sources & further analysis#
Reproductions & code
- Standalone PoC + full trace: 26043-h-09-rootbridgeagent-checkparamslibcheckparams-does-not-chec_exp (evm-hack-registry mirror).
- AuditVault finding: 26043-h-09-rootbridgeagent-checkparamslibcheckparams-does-not-chec.
Alerts & third-party analyses
These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.