Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Stake.Link rewards — incoming bridge update makes rewards insolvent

The controller's effective balance is increased before its already accrued rewards are checkpointed. It then claims old rewards on newly added stake, exceeding the funded reward pool.

Dec 2023•Other•logic•1 min read

Chain

Other

Category

logic

Date

Dec 2023

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 29745-not-update-rewards-in-handleincomingupdate-function-of-sdlpo. Standalone Foundry PoC and full write-up: 29745-not-update-rewards-in-handleincomingupdate-function-of-sdlpo_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/logic/reward-calculation · vuln/dos/frozen-funds

Key info#

FieldValue
ImpactSecondary-chain reward distribution reverts
ChainLocal synthetic

TL;DR#

The controller's effective balance is increased before its already accrued rewards are checkpointed. It then claims old rewards on newly added stake, exceeding the funded reward pool.

The vulnerable code#

SOLIDITY
effectiveBalances[CONTROLLER] += uint256(change); // @> VULN: effective balance changes without first settling controller rewards at the old rewardPerToken.

Attack walkthrough#

The PoC funds 1000 rewards at reward-per-token one, grows controller effective balance from 1000 to 2000, and catches the resulting 2000-unit withdrawal revert.

Diagrams#

flowchart LR U[Incoming update] --> B[Controller balance doubles] B --> C[Old reward checkpoint remains] C --> D[Claim exceeds reward pool]

Remediation#

Call the reward update/checkpoint routine for the controller before changing its effective balance.

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.