Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Kinetiq: cancelling a buffer withdrawal then redelegating locks 15 HYPE

Apr 2025•Other•dos•2 min read

Chain

Other

Category

dos

Date

Apr 2025

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 58553-h-01-buffer-silently-locks-staked-hype-in-contract-without-u. Standalone Foundry PoC and full write-up: 58553-h-01-buffer-silently-locks-staked-hype-in-contract-without-u_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/dos/frozen-funds · vuln/logic/state-update

A user queues a 15 HYPE withdrawal against a 20 HYPE buffer. queueWithdrawal reduces hypeBuffer to 5 but leaves the HYPE in the contract. cancelWithdrawal returns the kHYPE and adds 15 to _cancelledWithdrawalAmount without restoring the buffer. redelegateWithdrawnHYPE then zeroes that counter and sendCDeposits the 8-decimal amount. No value is sent to L1, so 15 HYPE stays in the contract and is tracked by nothing.

SOLIDITY
hypeBuffer = currentBuffer - amountFromBuffer; // 20 -> 5, HYPE still here
_cancelledWithdrawalAmount += hypeAmount;      // cancel does not restore the buffer
_cancelledWithdrawalAmount = 0;
l1Write.sendCDeposit(uint64(truncatedAmount)); // @> VULN: accounting moves, value does not

Diagrams#

flowchart TD A["Buffer holds 20 HYPE"] --> B["User queues a 15 HYPE withdrawal"] B --> C["Buffer falls to 5 and the HYPE stays in the contract"] C --> D["Manager cancels and returns kHYPE"] D --> E["Cancelled counter records 15 and the buffer stays at 5"] E --> F["Redelegate calls sendCDeposit and clears the counter"] F --> G["15 HYPE is left in the contract and tracked by nothing"]

Impact#

The contract balance is still 20 HYPE. hypeBuffer is 5, the queue is 0, and _cancelledWithdrawalAmount is 0. untracked() is 15 HYPE. The fixed cancel puts those 15 HYPE back into the buffer, so untracked() is 0.

PoC#

BASH
cd 58553-h-01-buffer-silently-locks-staked-hype-in-contract-without-u_exp
forge test -vv

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.