Reproduced Exploit
Cork — Reserve sales vulnerable to MEV due to missing slippage protection in `_sellDsReserve`
1. User RA→DS swaps can trigger a protocol reserve sale of DS for RA. 2. _sellDsReserve calls the swap with hardcoded amountOutMin = 0. 3. An MEV bot dumps DS into the pool first; the reserve sale realizes far less RA. 4. LP / protocol profit from the reserve sale drops materially (report: ~36%).
Chain
Other
Category
untagged
Date
Dec 2024
Source
AuditVault
EVM Playground
Source-level debugger — step opcodes and Solidity in sync
The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.
Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 53125-reserve-sales-vulnerable-to-mev-due-to-missing-slippage-prot. Standalone Foundry PoC and full write-up: 53125-reserve-sales-vulnerable-to-mev-due-to-missing-slippage-prot_exp in the
evm-hack-registrymirror.
Vulnerability classes: impact/mev/sandwich · fot-slippage · frontrun-exposure
Reproduction: self-contained Foundry PoC with only
forge-std— no fork. output.txt · test/53125-…_exp.sol.
AuditVault taxonomy: lang/solidity · sector/dex · platform/cantina · severity/high · genome: spot-price · sandwich · fot-slippage · frontrun-exposure
Key info#
| Impact | HIGH — protocol DS reserve sales use amountOutMin = 0, so MEV can cut LP profits (~36% in the report's e2e) |
| Protocol | Cork Protocol — FlashSwapRouter._sellDsReserve |
| Vulnerable code | __swapDsforRa(..., amountSellFromReserve, 0, _moduleCore) |
| Bug class | Hardcoded zero min-out on internal reserve sale |
| Finding | Cantina — Cork, December 2024 · #53125 · reporter Sujith Somraaj |
| Report | cantina_competition_cork_december2024.pdf |
| Source | AuditVault |
| Fix | Cork PR 280 — add slippage protection to reserve sales |
| Compiler | ^0.8.24 (PoC) |
TL;DR#
- User RA→DS swaps can trigger a protocol reserve sale of DS for RA.
_sellDsReservecalls the swap with hardcodedamountOutMin = 0.- An MEV bot dumps DS into the pool first; the reserve sale realizes far less RA.
- LP / protocol profit from the reserve sale drops materially (report: ~36%).
Diagrams#
Impact#
Reduced profits for liquidity providers; reserve sales sandwichable; negative pressure on protocol sustainability.
Sources#
- AuditVault #53125
- Cantina Cork Dec 2024
- Reduced
_sellDsReservepath from the finding (Cork PR 280 fixed)
Sources & further analysis#
Reproductions & code
- Standalone PoC + full trace: 53125-reserve-sales-vulnerable-to-mev-due-to-missing-slippage-prot_exp (evm-hack-registry mirror).
- AuditVault finding: 53125-reserve-sales-vulnerable-to-mev-due-to-missing-slippage-prot.
Alerts & third-party analyses
These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.