Streaming — recoverTokens broken after creatorClaimSoldTokens (isSale)

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 42396-h-10-recovertokens-doesnt-work-when-issale-is-true-code4rena. Standalone Foundry PoC and full write-up: 42396-h-10-recovertokens-doesnt-work-when-issale-is-true-code4rena_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/accounting/missing-state-update · vuln/loss-of-funds/locked-funds

Reproduction: a self-contained Foundry PoC that compiles & runs in an isolated project with only forge-std — no fork, no RPC, no anvil_state. Full trace: output.txt. PoC: test/42396-h-10-recovertokens-doesnt-work-when-issale-is-true-code4rena_exp.sol.

AuditVault taxonomy: lang/solidity · sector/token · platform/code4rena · severity/high · genome: wrong-condition · locked-funds

Key info#


Impact	HIGH — creatorClaimSoldTokens does not update redeemedDepositTokens, so recoverTokens underflows and excess deposit tokens are permanently locked
Protocol	Streaming Protocol
Finding	Code4rena — Streaming Protocol, 2021-11 · #42396
Report	2021-11-streaming
Source	AuditVault
Status	Audit finding — reproduced as a standalone local synthetic PoC.
Compiler	`^0.8.24` (PoC)

TL;DR#

creatorClaimSoldTokens does not update redeemedDepositTokens, so recoverTokens underflows and excess deposit tokens are permanently locked

See the vulnerable line marked // @> VULN in test/42396-h-10-recovertokens-doesnt-work-when-issale-is-true-code4rena.sol and the end-to-end Exploit.run() that asserts the harm.

Diagrams#

flowchart TD A[Setup vulnerable state] --> B[Attacker triggers vulnerable path] B --> C["Vulnerable line executes @> VULN"] C --> D[Harm asserted in run]

Impact#

creatorClaimSoldTokens does not update redeemedDepositTokens, so recoverTokens underflows and excess deposit tokens are permanently locked

Sources#

AuditVault finding
Code4rena report
Reduced source: synthetic reconstruction of the blamed functions from the contest repo (see finding for verbatim snippets).

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 42396-h-10-recovertokens-doesnt-work-when-issale-is-true-code4rena_exp (evm-hack-registry mirror).
AuditVault finding: 42396-h-10-recovertokens-doesnt-work-when-issale-is-true-code4rena.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync