Rubicon — Migration can underpay users via price manipulation

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 48953-h-14-users-might-get-less-assets-than-expected-upon-migratio. Standalone Foundry PoC and full write-up: 48953-h-14-users-might-get-less-assets-than-expected-upon-migratio_exp in the evm-hack-registry mirror.

Vulnerability classes: spot-price · price-manipulation · fot-slippage

Reproduction: self-contained Foundry PoC with only forge-std — no fork, no RPC. Full trace: output.txt. PoC: test/48953-h-14-users-might-get-less-assets-than-expected-upon-migratio_exp.sol.

Key info#


Impact	HIGH — V2Migrator.migrate has no slippage guard; inflated BathV2 rate can mint 0 shares and enable drain
Protocol	Rubicon
Bug class	spot-price · price-manipulation · fot-slippage
Finding	Code4rena 2023-04-rubicon · #48953 · H-14 · reporter 0xNineDec
Report	code4rena.com/reports/2023-04-rubicon
Source	AuditVault
Status	Confirmed. Reproduced as a standalone local synthetic.
Compiler	`^0.8.24` (PoC)

TL;DR#

migrate redeems V1 then mints V2 with no minOut; low-liquidity exchangeRate inflation rounds victim to 0 shares.

The vulnerable code#

See synthetic test/48953-h-14-users-might-get-less-assets-than-expected-upon-migratio.sol (@> VULN markers).

Fix: Require min shares out / simulate redeem and bind underlying received.

Root cause#

migrate redeems V1 then mints V2 with no minOut; low-liquidity exchangeRate inflation rounds victim to 0 shares.

Preconditions#

Protocol deployed with the vulnerable code paths from the Code4rena contest.

Attack walkthrough#

See PoC run() and output.txt.

Diagrams#

sequenceDiagram participant User participant Protocol User->>Protocol: trigger vulnerable path Protocol->>Protocol: hit @> VULN line Protocol-->>User: harm realized

Impact#

V2Migrator.migrate has no slippage guard; inflated BathV2 rate can mint 0 shares and enable drain

Taxonomy#

genome: spot-price · price-manipulation · fot-slippage
severity/high · platform/code4rena

Sources#

AuditVault finding #48953
Code4rena report 2023-04-rubicon
Repo@commit: code-423n4/2023-04-rubicon · contracts migrator + CToken mintFresh

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 48953-h-14-users-might-get-less-assets-than-expected-upon-migratio_exp (evm-hack-registry mirror).
AuditVault finding: 48953-h-14-users-might-get-less-assets-than-expected-upon-migratio.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync