Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

C-02: Missing packet ID in finalizeOpen causes NFT loss

Packet NFT stuck in contract; INSTANT_OPEN reverts; user loses NFT with no cards

May 2025•Other•untagged•2 min read

Chain

Other

Category

untagged

Date

May 2025

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 62593-c-02-missing-packet-id-in-finalizeopen-causes-nft-loss-pasho. Standalone Foundry PoC and full write-up: 62593-c-02-missing-packet-id-in-finalizeopen-causes-nft-loss-pasho_exp in the evm-hack-registry mirror.

FieldValue
ProtocolRipIt
Severityhigh
SourceAuditVault / https://github.com/pashov/audits/blob/master/team/md/RipIt-security-review_2025-05-10.md
HarmPacket NFT stuck in contract; INSTANT_OPEN reverts; user loses NFT with no cards

TL;DR#

Packet NFT stuck in contract; INSTANT_OPEN reverts; user loses NFT with no cards

Vulnerable code#

See the synthetic reproduction in test/62593-c-02-missing-packet-id-in-finalizeopen-causes-nft-loss-pasho.sol — the blamed line is marked // @> VULN.

Root cause#

Faithful reduction of the AuditVault finding. The vulnerable line is preserved so the Playground locator points at the real bug, not scaffolding.

Attack walkthrough#

  1. Deploy the reduced protocol pieces via the Exploit constructor.
  2. run() performs the attack end-to-end and requires the harm.

Diagrams#

sequenceDiagram participant A as Attacker participant V as Vulnerable participant T as Target A->>V: trigger vulnerable path V->>V: @> VULN line executes V->>T: harm materializes A->>A: assert harm

Impact#

Packet NFT stuck in contract; INSTANT_OPEN reverts; user loses NFT with no cards

Taxonomy#

  • severity/high
  • sector/nft
  • platform/auditvault

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.