Shido WSHIDO — transferFrom moves tokens when allowance is zero

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 35628-insufficient-src-validation-allows-malicious-users-to-steal. Standalone Foundry PoC and full write-up: 35628-insufficient-src-validation-allows-malicious-users-to-steal_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/logic/missing-check · vuln/access-control/broken-logic

Reproduction: a self-contained Foundry PoC that compiles and runs offline with only forge-std — no fork and no RPC. Trace: output.txt. PoC: test/35628-insufficient-src-validation-allows-malicious-users-to-steal_exp.sol.

Key info#

TL;DR#

WSHIDO is a WETH fork. transferFrom deducts allowance only when src != msg.sender and the allowance is not zero. After that if, it always debits src and credits dst.

A victim with 1,000 WSHIDO and allowance 0 loses the full balance to transferFrom. The fixed function reverts on that call and the victim keeps 1,000.

run() does not warp.

The vulnerable code#

if (src != msg.sender && allowance[src][msg.sender] != 0) {
    allowance[src][msg.sender] -= wad;
}
// @> VULN: zero allowance skips the branch and src is still debited
balanceOf[src] -= wad;
balanceOf[dst] += wad;

WETH9 requires allowance >= wad whenever the allowance is not uint.max. This fork replaced that require with a non-zero test, so the zero allowance is the path that skips the check.

Root cause#

The allowance update is not a guard. It is an optional side effect. The balance move is outside the condition, and both src and dst are arguments.

Preconditions#

• The victim's WSHIDO balance is 1,000 (18 decimals).
• allowance[victim][attacker] is 0.
• No timestamp change happens inside run().

Attack walkthrough#

1. Read the victim balance: 1,000. Read the allowance: 0.
2. transferFrom(victim, attacker, 1000 ether).
3. The allowance branch is skipped. balanceOf[victim] becomes 0. balanceOf[attacker] becomes 1,000.

Control: the same call on the fixed token reverts with allowance. The victim balance stays 1,000 and the attacker balance stays 0.

Diagrams#

Impact#

Any holder who has not approved the attacker can be debited for their full balance. Here that is 1,000 WSHIDO.

Remediation#

Require allowance[src][msg.sender] >= wad when src != msg.sender, and deduct inside that branch, matching WETH9. Do not move balances when the require fails.

Sources#

• AuditVault finding 35628
• Zokyo Shido, 28 May 2024

Taxonomy#

• severity/high
• vuln/logic/missing-check
• vuln/access-control/broken-logic

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 35628-insufficient-src-validation-allows-malicious-users-to-steal_exp (evm-hack-registry mirror).
• AuditVault finding: 35628-insufficient-src-validation-allows-malicious-users-to-steal.

Alerts & third-party analyses

• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.