Reproduced Exploit
Maia DAO — TalosBaseStrategy#init() lacks slippage protection
1. deposit() has checkDeviation; init() does not.\n2. amount0Min/amount1Min hardcoded to 0.\n3. Price manipulation drains 99% of init deposit.
Chain
Other
Category
untagged
Date
May 2023
Source
AuditVault
EVM Playground
Source-level debugger — step opcodes and Solidity in sync
The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.
Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 26044-h-10-talosbasestrategyinit-lacks-slippage-protection-code4re. Standalone Foundry PoC and full write-up: 26044-h-10-talosbasestrategyinit-lacks-slippage-protection-code4re_exp in the
evm-hack-registrymirror.
Vulnerability classes: see taxonomy below
Reproduction: a self-contained Foundry PoC that compiles & runs in an isolated project with only
forge-std— no fork, no RPC, noanvil_state. Full trace: output.txt. PoC: test/26044-h-10-talosbasestrategyinit-lacks-slippage-protection-code4re_exp.sol.
Key info#
| Impact | HIGH — init hardcodes amount0Min/1Min=0 and skips checkDeviation; sandwich extracts 99+99 of 100+100 deposit |
| Protocol | Maia DAO |
| Finding | Code4rena · reporter los_chicos |
| Report | https://code4rena.com/reports/2023-05-maia |
| Source | AuditVault |
| Status | Audit finding — reproduced as a standalone local PoC. |
| Compiler | ^0.8.24 (PoC) |
This is an audit finding, not a historical on-chain incident.
TL;DR#
- deposit() has checkDeviation; init() does not.\n2. amount0Min/amount1Min hardcoded to 0.\n3. Price manipulation drains 99% of init deposit.
Diagrams#
Impact#
init hardcodes amount0Min/1Min=0 and skips checkDeviation; sandwich extracts 99+99 of 100+100 deposit
Sources#
- AuditVault finding
- Code4rena report
- Reduced synthetic:
test/26044-h-10-talosbasestrategyinit-lacks-slippage-protection-code4re.sol(C2 local-deploy)
Sources & further analysis#
Reproductions & code
- Standalone PoC + full trace: 26044-h-10-talosbasestrategyinit-lacks-slippage-protection-code4re_exp (evm-hack-registry mirror).
- AuditVault finding: 26044-h-10-talosbasestrategyinit-lacks-slippage-protection-code4re.
Alerts & third-party analyses
These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.