Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Rubicon — RubiconMarket checks slippage incorrectly

sellAllAmount requires fill_amt >= min_fill_amount before calcAmountAfterFee, so a post-fee floor can be violated.

Apr 2023•Other•untagged•2 min read

Chain

Other

Category

untagged

Date

Apr 2023

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 48950-h-11-rubiconmarket-checks-slippage-incorrectly-code4rena-rub. Standalone Foundry PoC and full write-up: 48950-h-11-rubiconmarket-checks-slippage-incorrectly-code4rena-rub_exp in the evm-hack-registry mirror.

Vulnerability classes: fee-calculation · fot-slippage · direct-drain

Reproduction: self-contained Foundry PoC with only forge-std — no fork, no RPC. Full trace: output.txt. PoC: test/48950-h-11-rubiconmarket-checks-slippage-incorrectly-code4rena-rub_exp.sol.

Key info#

ImpactHIGH — User receives less than min_fill_amount after fees because slip check is pre-fee
ProtocolRubicon
Bug classfee-calculation · fot-slippage · direct-drain
FindingCode4rena 2023-04-rubicon · #48950 · H-11 · reporter zhuXKET
Reportcode4rena.com/reports/2023-04-rubicon
SourceAuditVault
StatusConfirmed. Reproduced as a standalone local synthetic.
Compiler^0.8.24 (PoC)

TL;DR#

sellAllAmount requires fill_amt >= min_fill_amount before calcAmountAfterFee, so a post-fee floor can be violated.

The vulnerable code#

See synthetic test/48950-h-11-rubiconmarket-checks-slippage-incorrectly-code4rena-rub.sol (@> VULN markers).

Fix: Apply calcAmountAfterFee before the min_fill_amount require.

Root cause#

sellAllAmount requires fill_amt >= min_fill_amount before calcAmountAfterFee, so a post-fee floor can be violated.

Preconditions#

Protocol deployed with the vulnerable code paths from the Code4rena contest.

Attack walkthrough#

See PoC run() and output.txt.

Diagrams#

sequenceDiagram participant User participant Protocol User->>Protocol: trigger vulnerable path Protocol->>Protocol: hit @> VULN line Protocol-->>User: harm realized

Impact#

User receives less than min_fill_amount after fees because slip check is pre-fee

Taxonomy#

  • genome: fee-calculation · fot-slippage · direct-drain
  • severity/high · platform/code4rena

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.