Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Music Protocol: redeeming a removed artist still pays 1,000 RECORD

Feb 2024•Other•logic•1 min read

Chain

Other

Category

logic

Date

Feb 2024

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 59402-redeeming-does-not-discount-tokens-of-removed-artists-leadin. Standalone Foundry PoC and full write-up: 59402-redeeming-does-not-discount-tokens-of-removed-artists-leadin_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/logic/reward-calculation

redeem calls _calcSinceLastPosition only while the artist is still verified. After removeArtist, a full redeem zeroes the user's stake and leaves artistStake at 1,000. A 2,000 RECORD pot split by stake therefore mints 1,000 RECORD to the removed artist. The still-verified artist, who also has 1,000 stake, should have received the whole pot.

SOLIDITY
if (live) {
    _calcSinceLastPosition(artist, _stake[artist][user].amount, false);
}
if (!live) skippedRedeem += _stake[artist][user].amount; // @> VULN

Diagrams#

flowchart TD A["Two verified artists each have 1,000 stake"] --> B["Owner removes the first artist"] B --> C["Staker redeems the full 1,000"] C --> D["artistStake is not reduced because the artist is not verified"] D --> E["getReward splits a 2,000 RECORD pot by the stale stake"] E --> F["Removed artist is minted 1,000 RECORD"]

Impact#

The removed artist receives 1,000 RECORD. Their artistStake is still 1,000. The fixed redeem subtracts the stake even after removal, so that artist is minted 0 and the active artist receives the full 2,000 RECORD.

PoC#

BASH
cd 59402-redeeming-does-not-discount-tokens-of-removed-artists-leadin_exp
forge test -vv

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.