Tapioca DAO — AaveStrategy rewards locked as unredeemable stkAAVE

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 27531-h-41-rewards-compounded-in-aavestrategy-are-unredeemable-cod. Standalone Foundry PoC and full write-up: 27531-h-41-rewards-compounded-in-aavestrategy-are-unredeemable-cod_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/frozen-funds · vuln/reward-accounting · vuln/direct-drain

Reproduction: self-contained Foundry PoC with only forge-std — no fork, no RPC. Full trace: output.txt. PoC: test/27531-h-41-rewards-compounded-in-aavestrategy-are-unredeemable-cod.sol.

Key info#


Impact	HIGH — claimed AAVE incentives auto-stake to stkAAVE and are never redeemed → permanent reward lock
Protocol	Tapioca DAO
Vulnerable code	`AaveStrategy.compound` — missing `stakingRewardToken.redeem`
Bug class	Incomplete reward path / frozen funds
Finding	Code4rena — Tapioca, 2023-07 · #27531 · reporter Ack
Report	code4rena.com/reports/2023-07-tapioca
Source	AuditVault
Status	Confirmed (dup #243)
Compiler	`^0.8.24` (PoC)

TL;DR#

AAVE incentivesController stakes claimed rewards into stkAAVE immediately.
compound() claims incentives but never calls redeem.
Strategy holds stkAAVE with zero free AAVE/WETH — rewards unusable.

The vulnerable code#

SOLIDITY

function compound() external {
    incentivesController.claimRewards(...); // auto-stakes to stkAAVE
    // @> VULN: never calls stakingRewardToken.redeem()
}

Fix: after cooldown, redeem stkAAVE → swap free AAVE → re-deposit WETH.

Root cause#

Compounding was designed around free rewardToken balances; the incentives path delivers staked receipts instead.

Attack walkthrough#

Strategy accrues 500 AAVE claimable incentives.
compound() stakes them as 500 stkAAVE.
Free AAVE = 0, WETH compounded = 0; no strategy path unlocks stk.

Diagrams#

sequenceDiagram participant Strat as AaveStrategy participant IC as IncentivesController participant Stk as stkAAVE Strat->>IC: claimRewards IC->>Stk: stake to Strat Note over Strat: free AAVE = 0, no redeem call

Impact#

Yield intended for depositors is permanently stuck as staked receipt tokens.

Taxonomy#

genome: frozen-funds, direct-drain, reward-accounting
sector: governance, lending, staking, staking-pool, token
severity: high
platform: code4rena

Sources#

AuditVault finding #27531
Code4rena report 2023-07-tapioca
Reduced from Tapioca AaveStrategy.compound + AAVE incentives stake path

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 27531-h-41-rewards-compounded-in-aavestrategy-are-unredeemable-cod_exp (evm-hack-registry mirror).
AuditVault finding: 27531-h-41-rewards-compounded-in-aavestrategy-are-unredeemable-cod.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync