Behodler — Double transfer in ERC677 `transferAndCall`

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 42454-h-03-double-transfer-in-the-transferandcall-function-of-erc6. Standalone Foundry PoC and full write-up: 42454-h-03-double-transfer-in-the-transferandcall-function-of-erc6_exp in the evm-hack-registry mirror.

Vulnerability classes: wrong-condition · direct-drain

Reproduction: self-contained Foundry PoC with only forge-std — no fork. Full trace: output.txt.

Key info#

TL;DR#

transferAndCall calls super.transfer and then _transfer again for the same _value, so the sender is debited twice and the receiver is credited twice.

The vulnerable code#

function transferAndCall(address _to, uint256 _value, bytes memory _data) public returns (bool success) {
  super.transfer(_to, _value);
  _transfer(msg.sender, _to, _value); // @> VULN
  if (isContract(_to)) {
      contractFallback(_to, _value, _data);
  }
  return true;
}

Root cause#

Redundant transfer after the ERC20 base transfer already moved the tokens. Flan inherits ERC677, so all transferAndCall users are affected.

Diagrams#

Impact#

Direct double debit on every Flan transferAndCall.

Sources#

• AuditVault: https://github.com/Auditware/AuditVault/blob/main/findings/42454-h-03-double-transfer-in-the-transferandcall-function-of-erc6.md
• Report: https://code4rena.com/reports/2022-01-behodler
• Repo: code-423n4/2022-01-behodler contracts/ERC677/ERC677.sol

Taxonomy: [[wrong-condition]] · [[direct-drain]] · severity/high · sector/dex

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 42454-h-03-double-transfer-in-the-transferandcall-function-of-erc6_exp (evm-hack-registry mirror).
• AuditVault finding: 42454-h-03-double-transfer-in-the-transferandcall-function-of-erc6.

Alerts & third-party analyses

• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.