Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Hinkal: moving a nullifier into tokenIds duplicates a 1,000,001 USDC note

Jun 2024•Other•logic•2 min read

Chain

Other

Category

logic

Date

Jun 2024

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 60148-the-protocol-can-be-drained-through-commitment-duplication-q. Standalone Foundry PoC and full write-up: 60148-the-protocol-can-be-drained-through-commitment-duplication-q_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/logic/missing-check · vuln/logic/state-update

formBasicInput appends tokenIds and then inputNullifiers. A transfer proof whose public input is the single nullifier 7 still verifies if that nullifier is placed in tokenIds and inputNullifiers is empty. insertNullifiers then writes nothing. Alice's old 1,000,001 USDC commitment stays spendable next to a new 1,000,000 USDC commitment. She withdraws both. The pool also held another depositor's 1,000,000 USDC, so she leaves with 2,000,001.

SOLIDITY
require(verifyProof(input), "proof");
insertNullifiers(inputNullifiers); // empty, so nullifier 7 is not spent
commitments[newNullifiers[i]] = Commitment(newOwners[i], newAmounts[i], false); // @> VULN

Diagrams#

flowchart TD A["Another depositor locks 1,000,000 USDC"] --> B["Alice deposits 1,000,001 USDC as nullifier 7"] B --> C["Alice resubmits the proof with 7 in tokenIds and no input nullifiers"] C --> D["The concatenated input still matches the proof"] D --> E["No nullifier is inserted and a new 1,000,000 note is added"] E --> F["Alice withdraws 2,000,001 USDC"]

Impact#

Alice's balance is 2,000,001 USDC after a 1,000,001 deposit. The extra 1,000,000 is the other depositor's USDC. The pool is empty and Bob's 1 USDC note is unbacked. The fixed path requires the verified input itself to be the nullifier list, so the swapped call reverts and the other 1,000,000 USDC stays in the contract.

PoC#

BASH
cd 60148-the-protocol-can-be-drained-through-commitment-duplication-q_exp
forge test -vv

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.