Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Burve SimplexDiamond — Unrestricted `diamondCut` allows unauthorized facet modifications

1. SimplexDiamond exposes diamondCut without AdminLib.validateOwner() (or any auth). 2. Any address can add/replace/remove facet selectors. 3. Attacker adds a drain facet and empties the diamond's token balance. 4. HARM: full TVL stolen.

Jan 2025•Other•untagged•2 min read

Chain

Other

Category

untagged

Date

Jan 2025

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 55210-c-03-unrestricted-diamondcut-allows-unauthorized-facet-modif. Standalone Foundry PoC and full write-up: 55210-c-03-unrestricted-diamondcut-allows-unauthorized-facet-modif_exp in the evm-hack-registry mirror.

Vulnerability classes: missing-modifier · admin-takeover · access-roles

Reproduction: self-contained Foundry PoC, offline, forge-std only. Full trace: output.txt.

Key info#

ImpactHIGH — anyone can replace facets and drain protocol TVL
ProtocolBurve — SimplexDiamond (EIP-2535)
Vulnerable codediamondCut with no owner/admin check
Bug classMissing access control on diamond upgrade surface
FindingPashov Audit Group — Burve, Jan 2025 · #55210 · C-03
ReportBurve-security-review_2025-01-29
SourceAuditVault
Compiler^0.8.24 (PoC)

TL;DR#

  1. SimplexDiamond exposes diamondCut without AdminLib.validateOwner() (or any auth).
  2. Any address can add/replace/remove facet selectors.
  3. Attacker adds a drain facet and empties the diamond's token balance.
  4. HARM: full TVL stolen.

The vulnerable code#

SOLIDITY
function diamondCut(bytes4 selector, address newFacet) external {
    // FIX: require(msg.sender == diamondOwner, "not owner");
    facets[selector] = newFacet; // @> VULN: unrestricted diamondCut
}

Root cause#

EIP-2535 upgrade entrypoint registered without an owner/admin guard.

Preconditions#

  • Diamond holds TVL (or any valuable storage/balance reachable via a new facet).
  • Attacker has no admin role.

Attack walkthrough#

  1. Protocol bootstraps honest facets; diamond holds 100e18.
  2. Attacker calls diamondCut(drainSelector, DrainFacet).
  3. Attacker calls drain(token, attacker) via the diamond fallback.
  4. HARM: 100e18 drained.

Diagrams#

sequenceDiagram participant Attacker participant Diamond as SimplexDiamond participant Drain as DrainFacet Note over Diamond: TVL = 100e18 Attacker->>Diamond: diamondCut(drainSel, DrainFacet) Note over Diamond: no owner check Attacker->>Diamond: drain(token, attacker) Diamond->>Drain: delegatecall Drain-->>Attacker: 100e18

Impact#

Complete loss of control of the diamond and any assets it holds.

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.