Tapioca DAO — steal oTAP contents via Magnetar exit/unlock

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 27532-h-42-attacker-can-steal-victims-otap-position-contents-via-m. Standalone Foundry PoC and full write-up: 27532-h-42-attacker-can-steal-victims-otap-position-contents-via-m_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/missing-modifier · vuln/direct-drain · vuln/vote-delegation-loop

Reproduction: self-contained Foundry PoC with only forge-std — no fork, no RPC. Full trace: output.txt. PoC: test/27532-h-42-attacker-can-steal-victims-otap-position-contents-via-m.sol.

Key info#


Impact	HIGH — two-step Magnetar call steals unlocked tOLP shares after victim approves oTAP
Protocol	Tapioca DAO
Vulnerable code	`MagnetarMarketModule._exitPositionAndRemoveCollateral` — caller-controlled user/targets
Bug class	Missing msg.sender==user + untrusted external targets
Finding	Code4rena — Tapioca, 2023-07 · #27532 · reporter Ack
Report	code4rena.com/reports/2023-07-tapioca
Source	AuditVault
Status	Confirmed by Tapioca
Compiler	`^0.8.24` (PoC)

TL;DR#

Victim approves Magnetar for oTAP so they can exit via the helper.
Attacker exits victim oTAP with a fake unlock target (no-op).
Attacker unlocks real tOLP with user=attacker → receives locked shares.

The vulnerable code#

SOLIDITY

// @> VULN: transfers victim oTAP without msg.sender==user
OTAP(oTapAddress).safeTransferFrom(user, address(this), tokenId, "0x");
// ...
// @> VULN: unlock target and user are caller-controlled
TOLP(unlockData.target).unlock(tOLPId, singularity, user);

Fix: require user == msg.sender; whitelist exit/unlock targets.

Root cause#

Multi-flag helper trusts all addresses and the user parameter once ERC721 approval exists for Magnetar.

Attack walkthrough#

Step1: exit=true, unlock=true, fake unlock target, user=victim.
Step2: exit=false, unlock=true, real tOLP, user=attacker.
Attacker holds 1000 share tokens; victim gets nothing.

Diagrams#

sequenceDiagram participant Victim participant Mag as Magnetar participant oTAP participant tOLP participant Attacker Victim->>oTAP: approve Magnetar Attacker->>Mag: exit+fake unlock user=Victim Mag->>oTAP: transferFrom Victim Attacker->>Mag: unlock real tOLP user=Attacker Mag->>tOLP: unlock to Attacker tOLP-->>Attacker: shares

Impact#

Theft of twAML-locked oTAP position contents (YieldBox shares behind tOLP).

Taxonomy#

genome: missing-modifier, direct-drain, vote-delegation-loop
sector: governance, lending, nft, staking
severity: high
platform: code4rena

Sources#

AuditVault finding #27532
Code4rena report 2023-07-tapioca
Reduced from MagnetarMarketModule._exitPositionAndRemoveCollateral

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 27532-h-42-attacker-can-steal-victims-otap-position-contents-via-m_exp (evm-hack-registry mirror).
AuditVault finding: 27532-h-42-attacker-can-steal-victims-otap-position-contents-via-m.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync