Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

InfiniFi — Referencing the gateway balance in `increaseUnwindingEpochs` can DoS the function

1. LockedPositionTokens are transferable until used to vote. 2. Bob transfers his position tokens to the gateway. 3. Alice deposits her own shares and approves only her amount, then calls increaseUnwindingEpochs. 4. Controller reads balanceOf(gateway) (= Alice+Bob) and tries to burnFrom more than A…

Mar 2025•Other•untagged•2 min read

Chain

Other

Category

untagged

Date

Mar 2025

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 55052-referencing-the-gateway-balance-in-lockingcontrollerincrease. Standalone Foundry PoC and full write-up: 55052-referencing-the-gateway-balance-in-lockingcontrollerincrease_exp in the evm-hack-registry mirror.

Vulnerability classes: dos-resistance · dos/lockup · impact/dos/permanent

Reproduction: self-contained Foundry PoC with only forge-std — no fork. output.txt · test/55052-…_exp.sol.

AuditVault taxonomy: lang/solidity · platform/spearbit · severity/high · genome: dos-resistance · dos/lockup · impact/dos/permanent

Key info#

ImpactHIGH — blind transfers of locked-position tokens to the gateway DoS increaseUnwindingEpochs for everyone
ProtocolInfiniFi Contracts — LockingController.increaseUnwindingEpochs
Vulnerable codeUses gateway's full balanceOf instead of the caller's share amount
Bug classWrong balance reference / transferable intermediate token
FindingSpearbit — InfiniFi, March 2025 · #55052 · reporter R0bert
ReportInfiniFi-Spearbit-Security-Review-March-2025.pdf
SourceAuditVault
Fixcommit 708f8bf — pass balanceOf(msg.sender) from the gateway
Compiler^0.8.24 (PoC)

TL;DR#

  1. LockedPositionTokens are transferable until used to vote.
  2. Bob transfers his position tokens to the gateway.
  3. Alice deposits her own shares and approves only her amount, then calls increaseUnwindingEpochs.
  4. Controller reads balanceOf(gateway) (= Alice+Bob) and tries to burnFrom more than Alice approved → revert. Alice is DoSed.

Diagrams#

sequenceDiagram participant Alice participant Bob participant GW as Gateway participant LC as LockingController Bob->>GW: transfer 1000 liUSD Alice->>GW: transfer 1000 liUSD + approve 1000 Alice->>GW: increaseUnwindingEpochs GW->>LC: increaseUnwindingEpochs LC->>LC: amount = balanceOf gateway = 2000 LC-->>GW: burnFrom reverts allowance 1000 Note over Alice: DoSed while Bob dust remains

Impact#

Denial of service on epoch increases for all users while any third-party tokens sit on the gateway.

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.