Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Uniswap The Compact — incorrect emissary storage slot breaks authorization

1. Emissary config slots must be keyed by (scope, sponsor, lockTag). 2. Buggy packing writes lockTag over the memory region holding sponsor. 3. All sponsors share one config per lockTag. 4. Attacker assignEmissary then claimAsEmissary steals any open lock for that tag. Fix: non-overlapping pack + h…

May 2025•Other•access-control•3 min read

Chain

Other

Category

access-control

Date

May 2025

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 61280-incorrect-storage-slot-derivation-breaks-authorization-spear. Standalone Foundry PoC and full write-up: 61280-incorrect-storage-slot-derivation-breaks-authorization-spear_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/access-control/auth-bypass · vuln/loss-of-funds/direct-drain · vuln/storage/slot-collision

Reproduction: a self-contained Foundry PoC that compiles & runs in an isolated project with only forge-std — no fork, no RPC, no anvil_state. Full trace: output.txt. PoC: test/61280-incorrect-storage-slot-derivation-breaks-authorization-spear_exp.sol.

AuditVault taxonomy: severity/high · sector/bridge · sector/dex · platform/spearbit · frozen-funds · direct-drain · bridge-sender-auth

Key info#

ImpactCRITICAL/HIGH — emissary config slot ignores sponsor; attacker sets emissary for any user and claims their resource locks
ProtocolUniswap The Compact — EmissaryLib._getEmissaryConfig
Vulnerable codeAssembly packs sponsor at 0x14 then mstore(0x20, lockTag) overwrites it before keccak256(0x1c, 0x24)
Bug classStorage slot collision / broken authorization domain
FindingSpearbit Uniswap The Compact May 2025 · #61280 · reporter Philogy
ReportUniswap-The-Compact-Spearbit-Security-Review-May-2025
SourceAuditVault
StatusAudit finding — fixed in commit 3caea0b7. Reproduced as a standalone local PoC.
Compiler^0.8.24 (PoC)

TL;DR#

  1. Emissary config slots must be keyed by (scope, sponsor, lockTag).
  2. Buggy packing writes lockTag over the memory region holding sponsor.
  3. All sponsors share one config per lockTag.
  4. Attacker assignEmissary then claimAsEmissary steals any open lock for that tag. Fix: non-overlapping pack + hash 0x30 bytes including sponsor.

The vulnerable code#

SOLIDITY
assembly ("memory-safe") {
    mstore(0x14, sponsor)
    mstore(0, scope)
    mstore(0x20, lockTag) // overwrites sponsor
    slot := keccak256(0x1c, 0x24) // @> VULN
}
// FIX: mstore(0x00, scope4); mstore(0x04, sponsor); mstore(0x24, lockTag);
//      slot := keccak256(0x00, 0x30)

Root cause#

mstore(0x14, sponsor) places the 20-byte address so its bytes begin at 0x20. The subsequent mstore(0x20, lockTag) clobbers them. The hashed region therefore never contains the sponsor, so msg.sender is not part of the authorization domain.

Preconditions#

  • Victim has locked balance under a lockTag.
  • Attacker can call assignEmissary (permissionless for own sponsor — but slot is shared).

Attack walkthrough#

  1. Victim deposits 100 LOCK under lockTag.
  2. Attacker assignEmissary(lockTag, attacker) — writes the shared slot.
  3. getEmissary(victim, lockTag) == attacker.
  4. Attacker claimAsEmissary(victim, lockTag, attackerRecv, 100) drains the lock.

Diagrams#

sequenceDiagram participant Victim participant Compact as TheCompact participant Attacker Victim->>Compact: deposit lockTag 100 LOCK Attacker->>Compact: assignEmissary lockTag self Note over Compact: shared slot ignores sponsor Attacker->>Compact: claimAsEmissary victim Compact-->>Attacker: 100 LOCK

Impact#

Any open resource lock for a given lockTag can be stolen once an attacker assigns the shared emissary. Affects all users; already-assigned emissaries only delay the attack until a reschedule window.

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.