ManifestFinance: A FULL_RESTRICTED (blacklisted/sanctioned) caller successfully deposits and mints 1000e18

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 62716-h-01-full-restricted-users-can-still-deposit-kann-none-manif. The historical source/toolchain is unavailable; this entry is documentation only and claims no executable Forge PoC.

Vulnerability classes: vuln/unfair-mint

Reproduction: a faithful minimal reproduction of the vulnerable finding — the vulnerable function is reproduced verbatim (marked @>) with faithful minimal doubles; local deploy, no fork.

Root cause#

A FULL_RESTRICTED (blacklisted/sanctioned) caller successfully deposits and mints 1000e18 vault shares to a clean receiver they control — a deposit that must revert with OperationNotAllowed instead succeeds, bypassing the compliance restriction; the fixed variant (caller-side FULL check) correctly reverts.

SOLIDITY


    // ── VERBATIM from the finding ────────────────────────────────────────────
    function _update(address from, address to, uint256 value) internal override {
        if (hasRole(FULL_RESTRICTED_STAKER_ROLE, from) && to != address(0)) { // @> only `from`/`to` are gated; the mint path passes from=address(0), so a FULL_RESTRICTED msg.sender/caller is never checked → bypass
            revert OperationNotAllowed();
        }

Why it's exploitable here#

Attack path#

flowchart TD S0["Mock underlying token"] S1["Test helper grants roles"] S2["Total supply accessor"] S3["Read sender balance"] S4["Store vault asset"] H["A FULL_RESTRICTED (blacklisted/sanctioned) caller successfully deposit"] S0 --> S1 S1 --> S2 S2 --> S3 S3 --> S4 S4 --> H

Marked-line walkthrough (Playground)#

The EVM Playground pins each step to the exact executed source line in 0x671d353a77…:

L42 — Mock underlying token: Setup: declares the mock ERC20 that acts as the vault's underlying asset for the deposit test.
L93 — Test helper grants roles: Setup: test-only helper used to grant compliance roles like FULL_RESTRICTED_STAKER_ROLE to an account.
L118 — Total supply accessor: Setup: standard totalSupply() view returning the vault's minted share count.
L134 — Read sender balance: Reads the from account's token balance inside the transfer/burn path before moving value.
L169 — Store vault asset: Setup: the vault records its underlying asset address during construction.
L194 — Deposit entry point: The _deposit core pulls assets from the caller and mints shares to the receiver — where the restriction should be enforced.
L228 — Restriction checks wrong party: Root cause: the guard only blocks a restricted from, but a deposit mints (from is zero), so a sanctioned caller bypasses the compliance check and mints shares.

PoC#

Registry (Foundry, local deploy — verbatim vulnerable source + harm-asserting test + negative control):

BASH

cd 62716-h-01-full-restricted-users-can-still-deposit-kann-none-manif_exp
forge test -vvv

The browser Playground replays the same synthetic opcode-for-opcode and measures the harm: **A FULL_RESTRICTED (blacklisted/sanctioned) caller successfully deposits and mints 1000e18 vault shares to a clean receiver they control — a **. Both gates are green (registry forge test PASS + Playground _verify-poc VERDICT: PASS).

Sources & further analysis#

Reproductions & code

No executable Forge reproduction is claimed; the historical source/toolchain was unavailable for this finding.
AuditVault finding: 62716-h-01-full-restricted-users-can-still-deposit-kann-none-manif.
Upstream DeFiHackLabs PoC directory: src/test.

Alerts & third-party analyses

DeFiHackLabs incident explorer: search "ManifestFinance: A FULL_RESTRICTED (blacklisted/sanctioned) caller successfully deposits and mints 1000e18".
Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync