Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

ZeroLend — Missing access control in afterLockUpdate

1. afterLockUpdate is intended to be called only by ZeroLocker after lock changes. 2. It is external with no caller restriction. 3. Anyone holding pool tokens can self-register a reward weight. 4. Emissions accrue and are claimed without ever locking.

Jan 2024•Other•untagged•2 min read

Chain

Other

Category

untagged

Date

Jan 2024

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 40821-missing-accesscontrol-in-afterlockupdate-cantina-none-zerole. Standalone Foundry PoC and full write-up: 40821-missing-accesscontrol-in-afterlockupdate-cantina-none-zerole_exp in the evm-hack-registry mirror.

Vulnerability classes: access-roles · reward-theft · reward-accounting

Reproduction: self-contained Foundry PoC with only forge-std — no fork. output.txt · test/40821-…sol.

AuditVault taxonomy: lang/solidity · platform/cantina · severity/high · sector/lending · genome: reward-calculation · variant · reward-theft · access-roles · reward-accounting

Key info#

ImpactHIGH — non-lockers register reward weight and drain emissions
ProtocolZeroLend — ZLRewardsController.afterLockUpdate
Vulnerable codeafterLockUpdate external with no onlyZeroLocker
Bug classMissing access control on balance registration
FindingCantina — ZeroLend, Jan 2024 · #40821 · reporter Sujith Somraaj
Reportcantina_competition_zerolend_jan2024.pdf
SourceAuditVault
FixonlyZeroLocker modifier
Compiler^0.8.24 (PoC)

TL;DR#

  1. afterLockUpdate is intended to be called only by ZeroLocker after lock changes.
  2. It is external with no caller restriction.
  3. Anyone holding pool tokens can self-register a reward weight.
  4. Emissions accrue and are claimed without ever locking.

Diagrams#

flowchart TD A["Attacker holds pool tokens"] --> B["afterLockUpdate attacker"] B --> C["registered balance = token balance"] C --> D["fundRewards emissions"] D --> E["attacker claimAll rewards"] E --> F["locker never called"]

Impact#

Reward emissions meant for locked stake (or authorized balance hooks) can be drained by unauthorized self-registration — matching the competition harness that registered users via a naked afterLockUpdate call.

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.