Tapioca DAO — GlpStrategy currentBalance ignores unclaimed rewards

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 27533-h-43-accounted-balance-of-glpstrategy-does-not-match-withdra. Standalone Foundry PoC and full write-up: 27533-h-43-accounted-balance-of-glpstrategy-does-not-match-withdra_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/rounding-direction · vuln/reward-theft · vuln/reward-accounting

Reproduction: self-contained Foundry PoC with only forge-std — no fork, no RPC. Full trace: output.txt. PoC: test/27533-h-43-accounted-balance-of-glpstrategy-does-not-match-withdra.sol.

Key info#


Impact	HIGH — deposit while rewards pending mints inflated shares; harvest then withdraw steals pro-rata rewards
Protocol	Tapioca DAO
Vulnerable code	`GlpStrategy._currentBalance` — free GLP only
Bug class	Incomplete NAV / reward accounting
Finding	Code4rena — Tapioca, 2023-07 · #27533 · reporter cergyk
Report	code4rena.com/reports/2023-07-tapioca
Source	AuditVault
Status	Confirmed by Tapioca
Compiler	`^0.8.24` (PoC)

TL;DR#

YieldBox prices shares from strategy.currentBalance().
_currentBalance omits unclaimed rewards.
Deposit → harvest → withdraw extracts older depositors' rewards.

The vulnerable code#

SOLIDITY

function _currentBalance() internal view returns (uint256 amount) {
    // @> VULN: ignores pending rewards
    amount = IERC20(contractAddress).balanceOf(address(this));
}

Fix: include claimable reward value in currentBalance.

Root cause#

Share mint uses incomplete TVL, so late depositors buy cheap shares against pending yield.

Attack walkthrough#

Victim deposits 1000 GLP (all free balance).
1000 GLP-equivalent rewards accrue off-balance.
Attacker deposits 1000 → gets 1000 shares (1:1 vs free only).
Harvest; attacker withdraws → +500 profit (half of pending).

Diagrams#

sequenceDiagram participant Victim participant YB as YieldBox participant Strat as GlpStrategy participant Attacker Victim->>YB: deposit 1000 Note over Strat: pending rewards 1000 not in currentBalance Attacker->>YB: deposit 1000 gets equal shares Attacker->>Strat: harvest Attacker->>YB: withdraw all shares Note over Attacker: +500 from victim rewards

Impact#

Theft of unclaimed strategy rewards from prior depositors.

Taxonomy#

genome: rounding-direction, reward-theft, variant, integer-bounds, reward-accounting
sector: governance
severity: high
platform: code4rena

Sources#

AuditVault finding #27533
Code4rena report 2023-07-tapioca
Reduced from GlpStrategy._currentBalance + YieldBox depositAsset share mint

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 27533-h-43-accounted-balance-of-glpstrategy-does-not-match-withdra_exp (evm-hack-registry mirror).
AuditVault finding: 27533-h-43-accounted-balance-of-glpstrategy-does-not-match-withdra.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync