Burve — DoS on `mint()` and `burn()` due to overestimation of available liquidity

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 57722-h-01-dos-on-mint-and-burn-due-to-overestimation-of-available. Standalone Foundry PoC and full write-up: 57722-h-01-dos-on-mint-and-burn-due-to-overestimation-of-available_exp in the evm-hack-registry mirror.

Vulnerability classes: dos-resistance · rounding-direction · fee-calculation · fix-arithmetic

Reproduction: self-contained Foundry PoC, offline, forge-std only. Full trace: output.txt.

Key info#


Impact	HIGH — mint and burn revert while dust residual remains
Protocol	Burve single (Uniswap V3 multi-range compounder)
Vulnerable code	`collectAndCalcCompound` overestimates mintable liquidity from dust
Bug class	Liquidity overestimate → transfer fail ("STF") → DoS
Finding	Pashov Audit Group — Burve, Mar 2025 · #57722 · H-01
Report	Burve-security-review_2025-03-05
Compiler	`^0.8.24` (PoC)

TL;DR#

Every mint/burn runs compoundV3Ranges → collectAndCalcCompound.
With 2 equal ranges and 1 wei residual, nominal liq is computed as 14.
Real mintable liquidity is 0 (1 wei cannot split across 2 ranges).
Compound tries to transfer more than available → "STF" → mint/burn DoS.

The vulnerable code#

SOLIDITY

mintNominalLiq = nominal - 2 * rangeCount; // @> VULN: residual treated as fully mintable
// later:
if (req0 > residual0) revert("STF");

Fix: dust floor or caller-supplied compound liquidity cap.

Diagrams#

sequenceDiagram participant User participant Burve participant Attacker User->>Burve: mint shares Attacker->>Burve: donate 1 wei dust User->>Burve: burn Note over Burve: collectAndCalcCompound = 14 Burve-->>User: revert STF

Impact#

Liveness failure on entry and exit; attacker can frontrun with dust donations.

Sources#

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 57722-h-01-dos-on-mint-and-burn-due-to-overestimation-of-available_exp (evm-hack-registry mirror).
AuditVault finding: 57722-h-01-dos-on-mint-and-burn-due-to-overestimation-of-available.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync