Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

THORWallet — MergeTgt has no deposit cap vs TGT_TO_EXCHANGE — late claimers stuck

MergeTgt has no deposit cap vs TGT_TO_EXCHANGE — late claimers stuck. Harm demonstrated: Over-subscribed TGT deposits leave late claimers unable to redeem TITN.

Feb 2025•Other•untagged•2 min read

Chain

Other

Category

untagged

Date

Feb 2025

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 55396-h-1-mergetgt-has-no-handling-if-tgttoexchange-is-exceeded-du. Standalone Foundry PoC and full write-up: 55396-h-1-mergetgt-has-no-handling-if-tgttoexchange-is-exceeded-du_exp in the evm-hack-registry mirror.

Vulnerability classes: integer-bounds, known-pattern

Reproduction: self-contained Foundry PoC (only forge-std) — no fork, no RPC. Full trace: output.txt. PoC: test/55396-h-1-mergetgt-has-no-handling-if-tgttoexchange-is-exceeded-du_exp.sol.

Key info#

ImpactHIGH — Over-subscribed TGT deposits leave late claimers unable to redeem TITN
ProtocolTHORWallet
Vulnerable codeMergeTgt (see @> in synthetic)
FindingCode4rena · #55396
Reporthttps://code4rena.com/reports/2025-02-thorwallet
SourceAuditVault
StatusAudit finding — reproduced as a standalone local PoC
Compiler^0.8.24

TL;DR#

MergeTgt has no deposit cap vs TGT_TO_EXCHANGE — late claimers stuck. Harm demonstrated: Over-subscribed TGT deposits leave late claimers unable to redeem TITN.

The vulnerable code#

See test/55396-h-1-mergetgt-has-no-handling-if-tgttoexchange-is-exceeded-du.sol — the blamed line is marked // @> VULN.

Root cause#

See the synthetic header comment and the AuditVault finding for the full root-cause write-up. The Playground preserves the vulnerable line verbatim and asserts the concrete harm in Exploit.run().

Attack walkthrough#

  1. Deploy the reduced vulnerable system (CREATE order: MockERC20(TGT), MockERC20(TITN), MergeTgt, UserActor1, UserActor2).
  2. Seed the preconditions from the finding (approvals, balances, whitelist).
  3. Execute the attack path; the @> line runs.
  4. require(...) asserts the harm.

Diagrams#

flowchart TD A["Attacker / user drives entrypoint"] --> B["Vulnerable contract path"] B --> C["@> VULN line executes"] C --> D["Harm: Over-subscribed TGT deposits leave late claimers unable to r"]

Impact#

Over-subscribed TGT deposits leave late claimers unable to redeem TITN

Taxonomy#

  • integer-bounds, known-pattern

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.