Reproduced Exploit

Phi — Forced endTime extension in updateArtSettings allows attacker to mint

After a mint event ends, updateArtSettings forces endTime_ >= now, reopening minting so an attacker can snipe residual maxSupply and dilute holders

Aug 2024Othertiming2 min read

Chain

Other

Category

timing

Date

Aug 2024

Source

AuditVault

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 41090-h-04-forced-endtime-extension-in-updateartsettings-allows-at. Standalone Foundry PoC and full write-up: 41090-h-04-forced-endtime-extension-in-updateartsettings-allows-at_exp in the evm-hack-registry mirror.


Vulnerability classes: vuln/timing/forced-window-reopen · vuln/nft/unauthorized-mint

Reproduction: a self-contained Foundry PoC that compiles & runs in an isolated project with only forge-std — no fork, no RPC, no anvil_state. Full trace: output.txt. PoC: test/41090-h-04-forced-endtime-extension-in-updateartsettings-allows-at_exp.sol.

AuditVault taxonomy: lang/solidity · sector/nft · platform/code4rena · severity/high · genome: timestamp-dependence · backrun · missing-owner-check


Key info#

ImpactHIGH — After a mint event ends, updateArtSettings forces endTime_ >= now, reopening minting so an attacker can snipe residual maxSupply and dilute holders
ProtocolPhi
FindingCode4rena — Phi, 2024-08 · #41090
Report2024-08-phi
SourceAuditVault
StatusAudit finding — reproduced as a standalone local synthetic PoC.
Compiler^0.8.24 (PoC)

TL;DR#

After a mint event ends, updateArtSettings forces endTime_ >= now, reopening minting so an attacker can snipe residual maxSupply and dilute holders

See the vulnerable line marked // @> VULN in test/41090-h-04-forced-endtime-extension-in-updateartsettings-allows-at.sol and the end-to-end Exploit.run() that asserts the harm.


Diagrams#

flowchart TD A[Setup vulnerable state] --> B[Attacker triggers vulnerable path] B --> C["Vulnerable line executes @> VULN"] C --> D[Harm asserted in run]

Impact#

After a mint event ends, updateArtSettings forces endTime_ >= now, reopening minting so an attacker can snipe residual maxSupply and dilute holders


Sources#


Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.