Putty — acceptCounterOffer may result in both orders being filled

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 42730-h-02-acceptcounteroffer-may-result-in-both-orders-being-fill. Standalone Foundry PoC and full write-up: 42730-h-02-acceptcounteroffer-may-result-in-both-orders-being-fill_exp in the evm-hack-registry mirror.

Vulnerability classes: wrong-condition · frontrun · frontrun-exposure

Reproduction: a self-contained Foundry PoC that compiles & runs in an isolated project with only forge-std — no fork, no RPC, no anvil_state. Full trace: output.txt. PoC: test/42730-h-02-acceptcounteroffer-may-result-in-both-orders-being-fill_exp.sol.

Key info#


Impact	HIGH — frontrun fill of original order + acceptCounterOffer fills both → double leverage
Protocol	Putty
Vulnerable code	`PuttyV2`
Bug class	wrong-condition
Finding	Code4rena — Putty, 2022-06 · #42730 · reporter hyh / kirk-baird et al.
Report	code4rena.com/reports/2022-06-putty
Source	AuditVault
Status	Audit finding — caught in review, not exploited on-chain. Reproduced as a standalone local PoC.
Compiler	`^0.8.24` (PoC)

This is an audit finding, not a historical on-chain incident. The PoC keeps the vulnerable logic verbatim (marked @> VULN) and reduces dependencies to the minimum needed to show the claimed harm.

TL;DR#

acceptCounterOffer cancels originalOrder then fills the counter order.
cancel() does not revert if the order was already filled.
Frontrunner fills original first; cancel is a no-op; counter still fills.
Maker ends twice leveraged with both order collaterals locked.

The vulnerable code#

See test/42730-h-02-acceptcounteroffer-may-result-in-both-orders-being-fill.sol — the @> VULN marker is on the blamed line (line 79 in the synthetic).

Root cause#

cancel marks cancelled without requiring the order is unfilled.

Preconditions#

Protocol operating conditions that make the path reachable (see finding report). No exotic privileges beyond those the real call path requires.

Attack walkthrough#

From output.txt: the Exploit.run() path executes the attack end-to-end and requires the harm.

Diagrams#

flowchart TD A[Setup reduced protocol state] --> B[Trigger vulnerable path] B --> C[VULN line executes] C --> D[Harm asserted]

Impact#

Both orders fill; maker posts 2× collateral / 2× leverage.

Sources#

AuditVault finding
Code4rena report
Protocol source: https://github.com/code-423n4/2022-06-putty

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 42730-h-02-acceptcounteroffer-may-result-in-both-orders-being-fill_exp (evm-hack-registry mirror).
AuditVault finding: 42730-h-02-acceptcounteroffer-may-result-in-both-orders-being-fill.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync