Magic Yearn MyStaking: a non-staker can zero stakerCount

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 57533-user-funds-lock-in-mystaking-due-to-stakercount-manipulation. Standalone Foundry PoC and full write-up: 57533-user-funds-lock-in-mystaking-due-to-stakercount-manipulation_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/dos/frozen-funds

Reproduction: faithful local reproduction of AuditVault 57533. withdraw decrements stakerCount without checking that the caller has a share.

Root cause#

stake increments stakerCount only when a user goes from zero shares to a position. withdraw always executes stakerCount -= 1. A caller with zero shares can drive the counter to zero. The real staker's later withdraw underflows and reverts.

SOLIDITY

uint256 share = shares[msg.sender];
shares[msg.sender] = 0;
// @> VULN: stakerCount decreases even when the caller has no share
stakerCount -= 1;
if (share > 0) token.transfer(msg.sender, share);

Attack path#

flowchart TD A["Victim stakes 1000 STK"] --> B["stakerCount is 1"] B --> C["Attacker with zero shares calls withdraw"] C --> D["stakerCount becomes 0"] D --> E["Victim withdraw underflows and reverts"] E --> F["1000 STK stays in MyStaking"]

Impact#

The victim's 1,000 STK cannot be withdrawn. The attacker's call moved no tokens. The fixed withdraw requires share > 0, so the zero-share call reverts and the victim exits with their 1,000 STK.

PoC#

BASH

cd 57533-user-funds-lock-in-mystaking-due-to-stakercount-manipulation_exp
forge test -vv

Sources#

AuditVault finding 57533
Zokyo, Magic Yearn, 2022-08-17: https://github.com/solodit/solodit_content/blob/main/reports/Zokyo/2022-08-17-Magic%20Yearn.md

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 57533-user-funds-lock-in-mystaking-due-to-stakercount-manipulation_exp (evm-hack-registry mirror).
AuditVault finding: 57533-user-funds-lock-in-mystaking-due-to-stakercount-manipulation.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync