Livepeer — By delegating to a non-transcoder, a delegator can reduce someone else's vote tally

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 27048-h-02-by-delegating-to-a-non-transcoder-a-delegator-can-reduc. Standalone Foundry PoC and full write-up: 27048-h-02-by-delegating-to-a-non-transcoder-a-delegator-can-reduc_exp in the evm-hack-registry mirror.

Vulnerability classes: see taxonomy below

Reproduction: a self-contained Foundry PoC that compiles & runs in an isolated project with only forge-std — no fork, no RPC, no anvil_state. Full trace: output.txt. PoC: test/27048-h-02-by-delegating-to-a-non-transcoder-a-delegator-can-reduc_exp.sol.

Key info#


Impact	HIGH — Missing isTranscoder check in vote override lets Bob cancel 1000 ungranted For votes and vote Against
Protocol	Livepeer
Finding	Code4rena · reporter Banditx0x
Report	https://code4rena.com/reports/2023-08-livepeer
Source	AuditVault
Status	Audit finding — reproduced as a standalone local PoC.
Compiler	`^0.8.24` (PoC)

This is an audit finding, not a historical on-chain incident.

TL;DR#

Non-transcoder Alice votes For with 100; Carol For 5000 → For=5100.\n2. Bob delegates 1000 to Alice, votes Against.\n3. Override subtracts 1000 from For without Alice ever holding that weight.\n4. For=4100, Against=1000 — double influence.

Diagrams#

flowchart TD A[Setup vulnerable state] --> B[Trigger vulnerable path] B --> C[Harm asserted in run]

Impact#

Missing isTranscoder check in vote override lets Bob cancel 1000 ungranted For votes and vote Against

Sources#

AuditVault finding
Code4rena report
Reduced synthetic: test/27048-h-02-by-delegating-to-a-non-transcoder-a-delegator-can-reduc.sol (C2 local-deploy)

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 27048-h-02-by-delegating-to-a-non-transcoder-a-delegator-can-reduc_exp (evm-hack-registry mirror).
AuditVault finding: 27048-h-02-by-delegating-to-a-non-transcoder-a-delegator-can-reduc.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync