Tapioca DAO — FakeBigBang steals Singularity assets via unwhitelisted Magnetar repay

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 27537-h-47-users-assets-can-be-stolen-when-removing-them-from-the. Standalone Foundry PoC and full write-up: 27537-h-47-users-assets-can-be-stolen-when-removing-them-from-the_exp in the evm-hack-registry mirror.

Vulnerability classes: fake-account-substitution, direct-drain, account-ownership

Reproduction: self-contained Foundry PoC (only forge-std) — no fork, no RPC. Full trace: output.txt. PoC: test/27537-h-47-users-assets-can-be-stolen-when-removing-them-from-the_exp.sol.

Key info#


Impact	HIGH — Victim Singularity assets drained to attacker via FakeBigBang YieldBox allowance
Protocol	Tapioca DAO
Vulnerable code	`Magnetar` (see `@>` in synthetic)
Finding	Code4rena · #27537
Report	https://code4rena.com/reports/2023-07-tapioca
Source	AuditVault
Status	Audit finding — reproduced as a standalone local PoC
Compiler	`^0.8.24`

TL;DR#

FakeBigBang steals Singularity assets via unwhitelisted Magnetar repay. Harm demonstrated: Victim Singularity assets drained to attacker via FakeBigBang YieldBox allowance.

The vulnerable code#

See test/27537-h-47-users-assets-can-be-stolen-when-removing-them-from-the.sol — the blamed line is marked // @> VULN.

Root cause#

See the synthetic header comment and the AuditVault finding for the full root-cause write-up. The Playground preserves the vulnerable line verbatim and asserts the concrete harm in Exploit.run().

Attack walkthrough#

Deploy the reduced vulnerable system (CREATE order: MockYieldBox, Singularity, Magnetar, FakeBigBang).
Seed the preconditions from the finding (approvals, balances, whitelist).
Execute the attack path; the @> line runs.
require(...) asserts the harm.

Diagrams#

flowchart TD A["Attacker / user drives entrypoint"] --> B["Vulnerable contract path"] B --> C["@> VULN line executes"] C --> D["Harm: Victim Singularity assets drained to attacker via FakeBigBan"]

Impact#

Victim Singularity assets drained to attacker via FakeBigBang YieldBox allowance

Taxonomy#

fake-account-substitution, direct-drain, account-ownership

Sources#

AuditVault finding
Code4rena report
Reduced from: Tapioca-DAO/tapioca-periph-audit MagnetarMarketModule remove+repay path

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 27537-h-47-users-assets-can-be-stolen-when-removing-them-from-the_exp (evm-hack-registry mirror).
AuditVault finding: 27537-h-47-users-assets-can-be-stolen-when-removing-them-from-the.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync