Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

H-1: notifyUnsubscribe gas underestimation leaves phantom gauge liquidity

Uniswap unsubscribes while Deli gauge keeps full position liquidity (phantom dilution)

Sep 2025•Other•untagged•2 min read

Chain

Other

Category

untagged

Date

Sep 2025

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 62808-h-1-gas-consumed-in-notifyunsubscribe-is-underestimated-duri. Standalone Foundry PoC and full write-up: 62808-h-1-gas-consumed-in-notifyunsubscribe-is-underestimated-duri_exp in the evm-hack-registry mirror.

FieldValue
ProtocolBMX Deli Swap
Severityhigh
SourceAuditVault / https://github.com/sherlock-audit/2025-09-bmx-deli-swap-judging
HarmUniswap unsubscribes while Deli gauge keeps full position liquidity (phantom dilution)

TL;DR#

Uniswap unsubscribes while Deli gauge keeps full position liquidity (phantom dilution)

Vulnerable code#

See the synthetic reproduction in test/62808-h-1-gas-consumed-in-notifyunsubscribe-is-underestimated-duri.sol — the blamed line is marked // @> VULN.

Root cause#

Faithful reduction of the AuditVault finding. The vulnerable line is preserved so the Playground locator points at the real bug, not scaffolding.

Attack walkthrough#

  1. Deploy the reduced protocol pieces via the Exploit constructor.
  2. run() performs the attack end-to-end and requires the harm.

Diagrams#

sequenceDiagram participant A as Attacker participant V as Vulnerable participant T as Target A->>V: trigger vulnerable path V->>V: @> VULN line executes V->>T: harm materializes A->>A: assert harm

Impact#

Uniswap unsubscribes while Deli gauge keeps full position liquidity (phantom dilution)

Taxonomy#

  • severity/high
  • sector/dex
  • platform/auditvault

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.