TraitForge — Buyer burn/nuke slashes original minter's airdrop allocation

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 37916-h-02-griefing-attack-on-sellers-airdrop-benefits-code4rena-t. Standalone Foundry PoC and full write-up: 37916-h-02-griefing-attack-on-sellers-airdrop-benefits-code4rena-t_exp in the evm-hack-registry mirror.

Vulnerability classes: griefing, reward-accounting, reentrancy-guard

Reproduction: self-contained Foundry PoC (only forge-std) — no fork, no RPC. Full trace: output.txt. PoC: test/37916-h-02-griefing-attack-on-sellers-airdrop-benefits-code4rena-t_exp.sol.

Key info#


Impact	HIGH — Seller airdrop allocation slashed to zero by buyer burn after transfer
Protocol	TraitForge
Vulnerable code	`TraitForgeNft` (see `@>` in synthetic)
Finding	Code4rena · #37916
Report	https://code4rena.com/reports/2024-07-traitforge
Source	AuditVault
Status	Audit finding — reproduced as a standalone local PoC
Compiler	`^0.8.24`

TL;DR#

Buyer burn/nuke slashes original minter's airdrop allocation. Harm demonstrated: Seller airdrop allocation slashed to zero by buyer burn after transfer.

The vulnerable code#

See test/37916-h-02-griefing-attack-on-sellers-airdrop-benefits-code4rena-t.sol — the blamed line is marked // @> VULN.

Root cause#

See the synthetic header comment and the AuditVault finding for the full root-cause write-up. The Playground preserves the vulnerable line verbatim and asserts the concrete harm in Exploit.run().

Attack walkthrough#

Deploy the reduced vulnerable system (CREATE order: Airdrop, TraitForgeNft, SellerActor, BuyerActor).
Seed the preconditions from the finding (approvals, balances, whitelist).
Execute the attack path; the @> line runs.
require(...) asserts the harm.

Diagrams#

flowchart TD A["Attacker / user drives entrypoint"] --> B["Vulnerable contract path"] B --> C["@> VULN line executes"] C --> D["Harm: Seller airdrop allocation slashed to zero by buyer burn afte"]

Impact#

Seller airdrop allocation slashed to zero by buyer burn after transfer

Taxonomy#

griefing, reward-accounting, reentrancy-guard

Sources#

AuditVault finding
Code4rena report
Reduced from: code-423n4/2024-07-traitforge contracts/TraitForgeNft/TraitForgeNft.sol burn()

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 37916-h-02-griefing-attack-on-sellers-airdrop-benefits-code4rena-t_exp (evm-hack-registry mirror).
AuditVault finding: 37916-h-02-griefing-attack-on-sellers-airdrop-benefits-code4rena-t.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync