Reproduced Exploit
Livepeer — Underflow in updateTranscoderWithFees can cause corrupted data and loss of winning tickets
1. treasuryRewardCutRate stored as PreciseMathUtils % (1e27).\n2. updateTranscoderWithFees uses MathUtils.percOf (1e6).\n3. 10% cut (1e26) → treasuryRewards >> rewards → underflow.\n4. Ticket redeem after skipped reward always reverts; ticket expires; fees lost.
Chain
Other
Category
untagged
Date
Aug 2023
Source
AuditVault
EVM Playground
Source-level debugger — step opcodes and Solidity in sync
The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.
Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 27047-h-01-underflow-in-updatetranscoderwithfees-can-cause-corrupt. Standalone Foundry PoC and full write-up: 27047-h-01-underflow-in-updatetranscoderwithfees-can-cause-corrupt_exp in the
evm-hack-registrymirror.
Vulnerability classes: see taxonomy below
Reproduction: a self-contained Foundry PoC that compiles & runs in an isolated project with only
forge-std— no fork, no RPC, noanvil_state. Full trace: output.txt. PoC: test/27047-h-01-underflow-in-updatetranscoderwithfees-can-cause-corrupt_exp.sol.
Key info#
| Impact | HIGH — MathUtils used on PreciseMath cut rate underflows; winning-ticket redeem DoS after skipped reward; 1000 FEE locked |
| Protocol | Livepeer |
| Finding | Code4rena · reporter VAD37 |
| Report | https://code4rena.com/reports/2023-08-livepeer |
| Source | AuditVault |
| Status | Audit finding — reproduced as a standalone local PoC. |
| Compiler | ^0.8.24 (PoC) |
This is an audit finding, not a historical on-chain incident.
TL;DR#
- treasuryRewardCutRate stored as PreciseMathUtils % (1e27).\n2. updateTranscoderWithFees uses MathUtils.percOf (1e6).\n3. 10% cut (1e26) → treasuryRewards >> rewards → underflow.\n4. Ticket redeem after skipped reward always reverts; ticket expires; fees lost.
Diagrams#
Impact#
MathUtils used on PreciseMath cut rate underflows; winning-ticket redeem DoS after skipped reward; 1000 FEE locked
Sources#
- AuditVault finding
- Code4rena report
- Reduced synthetic:
test/27047-h-01-underflow-in-updatetranscoderwithfees-can-cause-corrupt.sol(C2 local-deploy)
Sources & further analysis#
Reproductions & code
- Standalone PoC + full trace: 27047-h-01-underflow-in-updatetranscoderwithfees-can-cause-corrupt_exp (evm-hack-registry mirror).
- AuditVault finding: 27047-h-01-underflow-in-updatetranscoderwithfees-can-cause-corrupt.
Alerts & third-party analyses
These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.