Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Threshold USD — mintList early-return lets depositors run away with collateral

1. When BorrowerOperations is removed from thUSD.mintList, adjustment guards early-return. 2. ICR / recovery-mode checks never run for withdrawColl. 3. Alice withdraws nearly all collateral without repaying debt. 4. Trove ICR collapses to ~0 while bad debt remains against the system.

Jun 2023•Other•untagged•2 min read

Chain

Other

Category

untagged

Date

Jun 2023

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 54691-requirevalidadjustmentincurrentmode-bypass-when-not-in-mintl. Standalone Foundry PoC and full write-up: 54691-requirevalidadjustmentincurrentmode-bypass-when-not-in-mintl_exp in the evm-hack-registry mirror.

Vulnerability classes: wrong-condition · direct-drain · liquidation-underwater

Reproduction: self-contained Foundry PoC with only forge-std — no fork. output.txt · test/54691-…sol.

AuditVault taxonomy: lang/solidity · platform/cantina · severity/high · sector/cdp · sector/lending · sector/stable · genome: wrong-condition · direct-drain · liquidation-underwater

Key info#

ImpactHIGH — undercollateralized troves after deprecation; THUSD peg / system solvency at risk
ProtocolThreshold USD — BorrowerOperations._requireValidAdjustmentInCurrentMode
Vulnerable codeif (!thusdToken.mintList(address(this))) return;
Bug classEarly-return skips ICR invariants
FindingCantina — Threshold USD, Jun 2023 · #54691 · reporter Alex The Entreprenerd
Reportcantina_threshold_usd_june2023.pdf
SourceAuditVault
Fixcommit e05abc — same checks for normal and deprecated states
Compiler^0.8.24 (PoC)

TL;DR#

  1. When BorrowerOperations is removed from thUSD.mintList, adjustment guards early-return.
  2. ICR / recovery-mode checks never run for withdrawColl.
  3. Alice withdraws nearly all collateral without repaying debt.
  4. Trove ICR collapses to ~0 while bad debt remains against the system.

Diagrams#

flowchart TD A["Alice openTrove 300% ICR"] --> B["remove mintList BO"] B --> C["withdrawColl almost all"] C --> D["_requireValidAdjustment early return"] D --> E["Trove left with dust coll and full debt"] E --> F["System undercollateralized / peg risk"]

Impact#

All depositors on a deprecated BorrowerOperations instance can exit collateral without repayment, leaving underwater debt that threatens THUSD for that deployment.

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.