Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Powerloom: one validator finalizes a batch by attesting twice

Mar 2024•Other•logic•2 min read

Chain

Other

Category

logic

Date

Mar 2024

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 58812-validators-can-submit-multiple-attestations-to-maliciously-f. Standalone Foundry PoC and full write-up: 58812-validators-can-submit-multiple-attestations-to-maliciously-f_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/logic/missing-check · vuln/governance/proposal-manipulation

submitBatchAttestation counts a vote for the supplied root and never checks attestationsReceived. The finalization threshold is 2. One registered validator submits the same malicious root twice, the second vote crosses the threshold, and the 100 token batch settlement is paid to that validator.

SOLIDITY
// Missing: require(!attestationsReceived[batch][tx.origin]);
votes[batch][root] += 1; // @> VULN
if (votes[batch][root] >= THRESHOLD && !finalized[batch]) {
    finalized[batch] = true;
    reward.transfer(msg.sender, SETTLEMENT);
}

Diagrams#

flowchart TD A["One validator is registered and the threshold is 2"] --> B["Validator attests a malicious root"] B --> C["Vote count becomes 1 and the batch stays open"] C --> D["The same validator attests the same root again"] D --> E["Vote count becomes 2 and the root is finalized"] E --> F["100 settlement tokens are paid to that validator"]

Impact#

The malicious root is finalized with votes == 2 from a single validator. The validator receives 100 settlement tokens. With the missing check restored, the second attestation reverts, the batch stays open, and the 100 token escrow stays in the contract.

PoC#

BASH
cd 58812-validators-can-submit-multiple-attestations-to-maliciously-f_exp
forge test -vv

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.