Reproduced Exploit
Phi — Forced endTime extension in updateArtSettings allows attacker to mint
After a mint event ends, updateArtSettings forces endTime_ >= now, reopening minting so an attacker can snipe residual maxSupply and dilute holders
Chain
Other
Category
timing
Date
Aug 2024
Source
AuditVault
EVM Playground
Source-level debugger — step opcodes and Solidity in sync
The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.
Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 41090-h-04-forced-endtime-extension-in-updateartsettings-allows-at. Standalone Foundry PoC and full write-up: 41090-h-04-forced-endtime-extension-in-updateartsettings-allows-at_exp in the
evm-hack-registrymirror.
Vulnerability classes: vuln/timing/forced-window-reopen · vuln/nft/unauthorized-mint
Reproduction: a self-contained Foundry PoC that compiles & runs in an isolated project with only
forge-std— no fork, no RPC, noanvil_state. Full trace: output.txt. PoC: test/41090-h-04-forced-endtime-extension-in-updateartsettings-allows-at_exp.sol.
AuditVault taxonomy: lang/solidity · sector/nft · platform/code4rena · severity/high · genome: timestamp-dependence · backrun · missing-owner-check
Key info#
| Impact | HIGH — After a mint event ends, updateArtSettings forces endTime_ >= now, reopening minting so an attacker can snipe residual maxSupply and dilute holders |
| Protocol | Phi |
| Finding | Code4rena — Phi, 2024-08 · #41090 |
| Report | 2024-08-phi |
| Source | AuditVault |
| Status | Audit finding — reproduced as a standalone local synthetic PoC. |
| Compiler | ^0.8.24 (PoC) |
TL;DR#
After a mint event ends, updateArtSettings forces endTime_ >= now, reopening minting so an attacker can snipe residual maxSupply and dilute holders
See the vulnerable line marked // @> VULN in test/41090-h-04-forced-endtime-extension-in-updateartsettings-allows-at.sol and the
end-to-end Exploit.run() that asserts the harm.
Diagrams#
Impact#
After a mint event ends, updateArtSettings forces endTime_ >= now, reopening minting so an attacker can snipe residual maxSupply and dilute holders
Sources#
- AuditVault finding
- Code4rena report
- Reduced source: synthetic reconstruction of the blamed functions from the contest repo (see finding for verbatim snippets).
Sources & further analysis#
Reproductions & code
- Standalone PoC + full trace: 41090-h-04-forced-endtime-extension-in-updateartsettings-allows-at_exp (evm-hack-registry mirror).
- AuditVault finding: 41090-h-04-forced-endtime-extension-in-updateartsettings-allows-at.
Alerts & third-party analyses
These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.