Reproduced Exploit
CAP Labs — inconsistent vault balance tracking bricks borrowing
An untracked donation supplies physical tokens for burn, but the burn still decrements totalSupplies. The accounting invariant falls below totalBorrows and subsequent borrowing is disabled.
Chain
Other
Category
logic
Date
May 2025
Source
AuditVault
EVM Playground
Source-level debugger — step opcodes and Solidity in sync
The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.
Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 61528-inconsistent-balance-tracking-in-vault-creates-dos-for-asset. Standalone Foundry PoC and full write-up: 61528-inconsistent-balance-tracking-vault-dos_exp in the
evm-hack-registrymirror.
Vulnerability classes: vuln/logic/state-update · vuln/dos/frozen-funds · vuln/input-validation/missing
Reproduction: Fully local synthetic; run forge test and inspect output.txt. The Playground bundle replays the same 61528-inconsistent-balance-tracking-vault-dos invariant.
Key info#
| Field | Value |
|---|---|
| Loss | Borrowing capacity for the asset is denied (DoS); synthetic invariant reaches available=0 |
| Vulnerable contract | VaultLogic (reconstructed) |
| Attacker EOA | 0x1111111111111111111111111111111111111111 (synthetic caller) |
| Attack contract | Exploit |
| Attack tx | Local Exploit.run() call (no historical transaction) |
| Chain · block · date | Ethereum · local stub 0x1181d03 · 2025-05 |
| Compiler | Solidity 0.8.35 (pragma ^0.8.24) |
| Bug class | vuln/logic/state-update · vuln/dos/frozen-funds · vuln/input-validation/missing |
TL;DR#
An untracked donation supplies physical tokens for burn, but the burn still decrements totalSupplies. The accounting invariant falls below totalBorrows and subsequent borrowing is disabled.
Background#
AuditVault finding 61528-inconsistent-balance-tracking-vault-dos is an audit-time issue rather than a historical exploit. This write-up reduces the report to one state transition and keeps the claimed harm assertion executable offline.
The vulnerable code#
The minimized source is explicitly marked RECONSTRUCTED and preserves the report's blamed operation with an @> VULN marker in test/61528-inconsistent-balance-tracking-vault-dos.sol. It is byte-identical to the Playground synthetic source. No verified production source was available in this local checkout.
Root cause#
burn trusts the transferable balance instead of checking totalSupplies - totalBorrows before decrementing accounting.
Preconditions#
The affected protocol path is deployed; the attacker can reach the public operation described in the report. The synthetic removes unrelated integrations while preserving the state and authorization assumptions required for the finding.
Attack walkthrough#
- seed(100,90) → donate(5) → burn(15); totalSupplies=85, totalBorrows=90, maxBorrowable=0.
- The
run()method requires the broken invariant and setsconfirmed; the Forge trace records a passing test at output.txt:355. - The remediation is to validate the accounting/state transition before accepting the external call or to consume the one-time state.
Diagrams#
Remediation#
Validate external addresses and returned balances before updating state, and make each one-time transition explicit. Add invariant tests covering zero/deflationary/epoch-boundary inputs.
How to reproduce#
cd 61528-inconsistent-balance-tracking-vault-dos_exp
forge test -vvv
The browser replay uses scripts/poc-configs/61528-inconsistent-balance-tracking-vault-dos.mjs and the same local-deploy Exploit contract.
Sources#
- AuditVault finding
- Trail of Bits report
- Reduced local source: test/61528-inconsistent-balance-tracking-vault-dos.sol
- Forge regression: test/61528-inconsistent-balance-tracking-vault-dos_exp.sol
Sources & further analysis#
Reproductions & code
- Standalone PoC + full trace: 61528-inconsistent-balance-tracking-vault-dos_exp (evm-hack-registry mirror).
- AuditVault finding: 61528-inconsistent-balance-tracking-in-vault-creates-dos-for-asset.
Alerts & third-party analyses
These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.