Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Pheasant: reentrancy lets a relayer pull 90 from a 100 bond

Jun 2024•Other•reentrancy•2 min read

Chain

Other

Category

reentrancy

Date

Jun 2024

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 60329-reentrancy-lets-relayer-withdraw-more-than-expected-by-bond. Standalone Foundry PoC and full write-up: 60329-reentrancy-lets-relayer-withdraw-more-than-expected-by-bond_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/reentrancy/single-function

finalizeWithdrawalBond transfers the requested amount A before clearing withdrawalAmount or reducing totalLocked. The bond token callbacks into the relayer. The relayer bonded 30 and another relayer bonded 70, so totalLocked is 100 and A is 30. Each re-entry pulls another 30 while the request is still open. Three pulls succeed. 10 remains, which is 100 % 30. The relayer receives 90, of which 60 belonged to the other relayer.

SOLIDITY
uint256 A = withdrawalAmount[msg.sender];
require(token.balanceOf(address(this)) >= A, "short");
token.transfer(msg.sender, A); // @> VULN: callback before the request is cleared
if (totalLocked >= A) totalLocked -= A;
withdrawalAmount[msg.sender] = 0;

Diagrams#

flowchart TD A["Relayer bonds 30 and another relayer bonds 70"] --> B["Relayer requests a withdrawal of 30"] B --> C["finalize transfers 30 before clearing the request"] C --> D["Token callback re-enters finalize"] D --> E["Two more pulls of 30 succeed"] E --> F["Relayer holds 90 and 10 remains in the bond"]

Impact#

The relayer receives 90 tokens. The bond contract keeps 10. totalLocked ends at 10, so the other relayer's 70 is no longer backed. The fixed function clears the request and decreases the bond before the transfer, and the callback's second entry reverts. The relayer receives 30 and 70 stays in the contract.

PoC#

BASH
cd 60329-reentrancy-lets-relayer-withdraw-more-than-expected-by-bond_exp
forge test -vv

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.