Tapioca DAO — OFT self-call makes Magnetar msg.sender and bypasses _checkSender

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 32317-h-06-attacker-can-use-magnetaractionoft-action-of-the-magnet. Standalone Foundry PoC and full write-up: 32317-h-06-attacker-can-use-magnetaractionoft-action-of-the-magnet_exp in the evm-hack-registry mirror.

Vulnerability classes: missing-modifier, direct-drain, access-roles

Reproduction: self-contained Foundry PoC (only forge-std) — no fork, no RPC. Full trace: output.txt. PoC: test/32317-h-06-attacker-can-use-magnetaractionoft-action-of-the-magnet_exp.sol.

Key info#


Impact	HIGH — Nested OFT self-call drains victim collateral approved to Magnetar
Protocol	Tapioca DAO
Vulnerable code	`Magnetar` (see `@>` in synthetic)
Finding	Code4rena · #32317
Report	https://code4rena.com/reports/2024-02-tapioca
Source	AuditVault
Status	Audit finding — reproduced as a standalone local PoC
Compiler	`^0.8.24`

TL;DR#

OFT self-call makes Magnetar msg.sender and bypasses _checkSender. Harm demonstrated: Nested OFT self-call drains victim collateral approved to Magnetar.

The vulnerable code#

See test/32317-h-06-attacker-can-use-magnetaractionoft-action-of-the-magnet.sol — the blamed line is marked // @> VULN.

Root cause#

See the synthetic header comment and the AuditVault finding for the full root-cause write-up. The Playground preserves the vulnerable line verbatim and asserts the concrete harm in Exploit.run().

Attack walkthrough#

Deploy the reduced vulnerable system (CREATE order: Cluster, MockERC20, Market, Magnetar).
Seed the preconditions from the finding (approvals, balances, whitelist).
Execute the attack path; the @> line runs.
require(...) asserts the harm.

Diagrams#

flowchart TD A["Attacker / user drives entrypoint"] --> B["Vulnerable contract path"] B --> C["@> VULN line executes"] C --> D["Harm: Nested OFT self-call drains victim collateral approved to Ma"]

Impact#

Nested OFT self-call drains victim collateral approved to Magnetar

Taxonomy#

missing-modifier, direct-drain, access-roles

Sources#

AuditVault finding
Code4rena report
Reduced from: Tapioca-DAO/tapioca-periph Magnetar._processOFTOperation + _checkSender

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 32317-h-06-attacker-can-use-magnetaractionoft-action-of-the-magnet_exp (evm-hack-registry mirror).
AuditVault finding: 32317-h-06-attacker-can-use-magnetaractionoft-action-of-the-magnet.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync