Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Tapioca DAO — mintBBLendXChainSGL compose data.user not bound — force-lend victim

mintBBLendXChainSGL compose data.user not bound — force-lend victim. Harm demonstrated: Whitelisted USDO compose forces lend of victim tokens into Magnetar.

Feb 2024•Other•untagged•2 min read

Chain

Other

Category

untagged

Date

Feb 2024

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 32312-h-01-magnetarmintxchainmodulesolmintbblendxchainsgl-can-be-u. Standalone Foundry PoC and full write-up: 32312-h-01-magnetarmintxchainmodulesolmintbblendxchainsgl-can-be-u_exp in the evm-hack-registry mirror.

Vulnerability classes: missing-modifier, direct-drain, account-ownership

Reproduction: self-contained Foundry PoC (only forge-std) — no fork, no RPC. Full trace: output.txt. PoC: test/32312-h-01-magnetarmintxchainmodulesolmintbblendxchainsgl-can-be-u_exp.sol.

Key info#

ImpactHIGH — Whitelisted USDO compose forces lend of victim tokens into Magnetar
ProtocolTapioca DAO
Vulnerable codeMagnetarMintXChainModule (see @> in synthetic)
FindingCode4rena · #32312
Reporthttps://code4rena.com/reports/2024-02-tapioca
SourceAuditVault
StatusAudit finding — reproduced as a standalone local PoC
Compiler^0.8.24

TL;DR#

mintBBLendXChainSGL compose data.user not bound — force-lend victim. Harm demonstrated: Whitelisted USDO compose forces lend of victim tokens into Magnetar.

The vulnerable code#

See test/32312-h-01-magnetarmintxchainmodulesolmintbblendxchainsgl-can-be-u.sol — the blamed line is marked // @> VULN.

Root cause#

See the synthetic header comment and the AuditVault finding for the full root-cause write-up. The Playground preserves the vulnerable line verbatim and asserts the concrete harm in Exploit.run().

Attack walkthrough#

  1. Deploy the reduced vulnerable system (CREATE order: Cluster, MockERC20, MagnetarAssetXChainModule, USDO, MagnetarMintXChainModule).
  2. Seed the preconditions from the finding (approvals, balances, whitelist).
  3. Execute the attack path; the @> line runs.
  4. require(...) asserts the harm.

Diagrams#

flowchart TD A["Attacker / user drives entrypoint"] --> B["Vulnerable contract path"] B --> C["@> VULN line executes"] C --> D["Harm: Whitelisted USDO compose forces lend of victim tokens into M"]

Impact#

Whitelisted USDO compose forces lend of victim tokens into Magnetar

Taxonomy#

  • missing-modifier, direct-drain, account-ownership

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.