Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Tapioca DAO — Unwhitelisted marketHelper returns malicious removeCollateral payload

Unwhitelisted marketHelper returns malicious removeCollateral payload. Harm demonstrated: Malicious marketHelper steals victim collateral via Magnetar approval.

Feb 2024•Other•untagged•2 min read

Chain

Other

Category

untagged

Date

Feb 2024

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 32313-h-02-missing-check-on-helper-contract-allows-arbitrary-actio. Standalone Foundry PoC and full write-up: 32313-h-02-missing-check-on-helper-contract-allows-arbitrary-actio_exp in the evm-hack-registry mirror.

Vulnerability classes: missing-modifier, direct-drain, access-roles

Reproduction: self-contained Foundry PoC (only forge-std) — no fork, no RPC. Full trace: output.txt. PoC: test/32313-h-02-missing-check-on-helper-contract-allows-arbitrary-actio_exp.sol.

Key info#

ImpactHIGH — Malicious marketHelper steals victim collateral via Magnetar approval
ProtocolTapioca DAO
Vulnerable codeMagnetarOptionModule (see @> in synthetic)
FindingCode4rena · #32313
Reporthttps://code4rena.com/reports/2024-02-tapioca
SourceAuditVault
StatusAudit finding — reproduced as a standalone local PoC
Compiler^0.8.24

TL;DR#

Unwhitelisted marketHelper returns malicious removeCollateral payload. Harm demonstrated: Malicious marketHelper steals victim collateral via Magnetar approval.

The vulnerable code#

See test/32313-h-02-missing-check-on-helper-contract-allows-arbitrary-actio.sol — the blamed line is marked // @> VULN.

Root cause#

See the synthetic header comment and the AuditVault finding for the full root-cause write-up. The Playground preserves the vulnerable line verbatim and asserts the concrete harm in Exploit.run().

Attack walkthrough#

  1. Deploy the reduced vulnerable system (CREATE order: Cluster, BigBang, MagnetarOptionModule, MaliciousMarketHelper).
  2. Seed the preconditions from the finding (approvals, balances, whitelist).
  3. Execute the attack path; the @> line runs.
  4. require(...) asserts the harm.

Diagrams#

flowchart TD A["Attacker / user drives entrypoint"] --> B["Vulnerable contract path"] B --> C["@> VULN line executes"] C --> D["Harm: Malicious marketHelper steals victim collateral via Magnetar"]

Impact#

Malicious marketHelper steals victim collateral via Magnetar approval

Taxonomy#

  • missing-modifier, direct-drain, access-roles

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.