Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Blueberry HyperliquidEscrow — tvl() omits in-flight USDC

1. Non-USDC assets add same-block in-flight bridge amounts into TVL. 2. The USDC branch only counts balanceOf and skips in-flight. 3. Deposit against understated TVL mints 2× shares; redeem after settle steals 250 USDC.

May 2025•Other•logic•2 min read

Chain

Other

Category

logic

Date

May 2025

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 61494-h-01-escrowtvl-does-not-add-in-flight-usdc-amount-pashov-aud. Standalone Foundry PoC and full write-up: 61494-h-01-escrowtvl-does-not-add-in-flight-usdc-amount-pashov-aud_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/logic/wrong-state · impact/loss-of-funds/direct-drain · frozen-funds

Reproduction: a self-contained Foundry PoC that compiles & runs in an isolated project with only forge-std — no fork, no RPC. Full trace: output.txt. PoC: test/61494-h-01-escrowtvl-does-not-add-in-flight-usdc-amount-pashov-aud_exp.sol.

AuditVault taxonomy: severity/high · sector/bridge · sector/lending · platform/pashov · locked-funds · oracle-freshness

Key info#

ImpactHIGH — understated TVL during USDC bridge → excess shares → drain honest LPs
ProtocolBlueberry HyperliquidEscrow
Vulnerable codetvl() USDC branch skips in-flight bridge amount
Bug classIncomplete TVL / share-price accounting
FindingPashov Audit Group Blueberry 2025-05-16 · #61494 · H-01
ReportBlueberry-security-review_2025-05-16
SourceAuditVault
StatusAudit finding. Reproduced as a standalone local PoC.
Compiler^0.8.24 (PoC)

TL;DR#

  1. Non-USDC assets add same-block in-flight bridge amounts into TVL.
  2. The USDC branch only counts balanceOf and skips in-flight.
  3. Deposit against understated TVL mints 2× shares; redeem after settle steals 250 USDC.

The vulnerable code#

SOLIDITY
if (assetIndex == USDC_SPOT_INDEX) {
    tvl_ += IERC20(assetAddr).balanceOf(address(this)) * evmScaling; // @> VULN
    // FIX: also add inFlightBridge[USDC].amount when same block
}

Root cause#

USDC bridging reduces EVM balance while the value remains protocol-owned in-flight. Omitting that amount understates TVL and share price for same-block depositors/redeemers.

Attack walkthrough#

  1. Seed 1000 USDC → TVL 1000e18.
  2. Bridge 500 USDC → buggy TVL 500e18 (correct 1000e18).
  3. Deposit 500 USDC → 1000e18 shares (fair 500e18).
  4. Settle bridge; redeem → 750 USDC out; profit 250 USDC.

Diagrams#

sequenceDiagram participant LP participant Escrow as HyperliquidEscrow participant Attacker LP->>Escrow: seed 1000 USDC Escrow->>Escrow: bridgeUsdcToL1 500 Note over Escrow: buggy TVL 500 vs correct 1000 Attacker->>Escrow: deposit 500 against low TVL Escrow->>Escrow: settleBridge 500 Attacker->>Escrow: redeem excess shares Escrow-->>Attacker: 750 USDC

Impact#

Same-block USDC bridge + deposit yields excess shares and extracts value from honest LPs. Symmetric redeem-at-low-TVL can also strand depositors.

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.