Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Altr: a documented 4% grace fee charges 4,000 on a 1,000 debt

Jun 2024•Other•logic•1 min read

Chain

Other

Category

logic

Date

Jun 2024

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 60243-inconsistent-use-of-basis-points-leading-to-enormous-fees-qu. Standalone Foundry PoC and full write-up: 60243-inconsistent-use-of-basis-points-leading-to-enormous-fees-qu_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/logic/fee-calculation · vuln/arithmetic/precision-loss

PRECISION is 10,000 and MAX_REPAY_GRACE_FEE is 4 * PRECISION. The comments treat that cap as 4%. repay computes platformFee += (totalPayable * repayGraceFee) / PRECISION. On a 1,000 debt that is 1000 * 40000 / 10000 = 4000, four times the debt, instead of the 40 a basis-point 4% would charge.

SOLIDITY
uint256 public constant PRECISION = 10000;
uint256 public constant MAX_REPAY_GRACE_FEE = 4 * PRECISION;
platformFee += (totalPayable * repayGraceFee) / PRECISION; // @> VULN

Diagrams#

flowchart TD A["Grace fee is set to 4 times PRECISION"] --> B["Borrower repays a 1,000 debt"] B --> C["Fee is computed as debt times 40000 divided by 10000"] C --> D["4,000 is pulled to the fee recipient"] D --> E["1,000 principal is paid to the lender"] E --> F["Borrower paid 3,960 more than a 4 percent fee"]

Impact#

The fee recipient receives 4,000. The lender receives the 1,000 principal. A fee stored as 400 basis points, with the same division, charges 40. The excess is 3,960.

PoC#

BASH
cd 60243-inconsistent-use-of-basis-points-leading-to-enormous-fees-qu_exp
forge test -vv

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.