DaosLive — sniped tokens are paid to the contract and cannot be withdrawn

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 57868-h-01-swapped-tokens-during-finalize-permanently-stuck-in-dao. Standalone Foundry PoC and full write-up: 57868-h-01-swapped-tokens-during-finalize-permanently-stuck-in-dao_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/dos/frozen-funds · vuln/logic/missing-check

Reproduction: a self-contained Foundry PoC that compiles and runs offline with only forge-std — no fork and no RPC. Trace: output.txt. PoC: test/57868-h-01-swapped-tokens-during-finalize-permanently-stuck-in-dao_exp.sol.

Key info#

TL;DR#

finalize calls exactInputSingle with recipient: address(this). The router mints 1000 ether of tokens to DaosLive. The contract has no sweep, no withdraw, and no forward. A call to sweep(address) hits no function and returns false. The balance stays 1000 ether. The treasury balance stays 0.

The fixed call sets recipient to the treasury. The treasury then holds 1000 ether and DaosLive holds 0.

The vulnerable code#

address recipient = toTreasury ? address(treasury) : address(this);
// @> VULN: recipient is address(this). Nothing in this contract can withdraw the tokens.
amountOut = router.exactInputSingle(
    ExactInputSingleParams({
        tokenIn: address(0),
        tokenOut: address(token),
        fee: 3000,
        recipient: recipient,
        amountIn: snipeAmount,
        amountOutMinimum: 0,
        sqrtPriceLimitX96: 0,
        deadline: block.timestamp
    })
);

toTreasury is false on the vulnerable contract, so recipient is address(this). The audited source is DaosLive.sol line 314 at commit 9a1856db, where the field is the literal address(this).

Root cause#

The swap succeeds and the tokens have an owner. That owner is the launch contract, and the launch contract has no function that can move an ERC-20 balance.

Preconditions#

• snipeAmount is 1000 ether.
• The router mints amountIn tokens to params.recipient when the deadline is the current block.

Attack walkthrough#

1. finalize sets the recipient to itself and calls the router.
2. The router mints 1000 ether of tokens to DaosLive.
3. sweep(address) is called. There is no such function. The call returns false.
4. DaosLive still holds 1000 ether. The treasury holds 0.

Control: recipient is the treasury. finalize returns 1000 ether, the treasury balance is 1000 ether, and the contract balance is 0.

Diagrams#

Impact#

1000 ether of the sniped token are stuck on DaosLive. Nothing in the contract can send them to the DAO. Sending them straight to the treasury leaves 0 on the contract and 1000 ether on the treasury.

Remediation#

Pass the DAO treasury as recipient, or add an authorized sweep that forwards any ERC-20 balance off DaosLive.

Sources#

• AuditVault finding 57868
• Shieldify DaosLive review
• ED3N-Ventures/daoslive-sc@9a1856db DaosLive.sol

Taxonomy#

• severity/high
• vuln/dos/frozen-funds · vuln/logic/missing-check

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 57868-h-01-swapped-tokens-during-finalize-permanently-stuck-in-dao_exp (evm-hack-registry mirror).
• AuditVault finding: 57868-h-01-swapped-tokens-during-finalize-permanently-stuck-in-dao.

Alerts & third-party analyses

• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.