Etherspot: A smart-contract wallet's partial invoice payment (40e18 tokens) is permanently locked in

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 62849-h-02-paid-tokens-by-smart-contract-wallets-are-not-refunded. The historical source/toolchain is unavailable; this entry is documentation only and claims no executable Forge PoC.

Vulnerability classes: vuln/locked-funds

Reproduction: a faithful minimal reproduction of the vulnerable finding — the vulnerable function is reproduced verbatim (marked @>) with faithful minimal doubles; local deploy, no fork.

Root cause#

A smart-contract wallet's partial invoice payment (40e18 tokens) is permanently locked in InvoiceManager when a SETTLER cancels the stuck invoice: cancelInvoice deletes all credited-token accounting with no refund to the paying wallet, and the only exit (emergencyWithdraw) sweeps to the admin.

SOLIDITY

    }

    // ─────────────── VERBATIM from InvoiceManager.sol L272-279 ───────────────
    // The only exit for stranded tokens: sweeps to the admin (msg.sender), NOT
    // back to the paying smart wallet. Not a refund path for the SCW.
    function emergencyWithdraw(address _token, uint256 _amount) external onlyRole(DEFAULT_ADMIN_ROLE) {

Why it's exploitable here#

Attack path#

flowchart TD S0["Declare credible-account role"] S1["Mark invoice open for solver"] S2["Grant admin role to owner"] S3["Credit paid tokens to invoice"] S4["Check if token fully paid"] H["A smart-contract wallet's partial invoice payment (40e18 tokens) is pe"] S0 --> S1 S1 --> S2 S2 --> S3 S3 --> S4 S4 --> H

Marked-line walkthrough (Playground)#

The EVM Playground pins each step to the exact executed source line in 0xce01759b82…:

L124 — Declare credible-account role: Setup: defines the CREDIBLE_ACCOUNT_ROLE constant used to gate access on the invoice manager.
L171 — Mark invoice open for solver: Records that a solver's session key now has an open invoice — the object a smart-contract wallet later pays into.
L192 — Grant admin role to owner: Setup: constructor gives the owner DEFAULT_ADMIN_ROLE, the same role that controls the only fund-exit path.
L225 — Credit paid tokens to invoice: creditTokensToInvoice books a paying wallet's tokens against the invoice — where the wallet's 40e18 partial payment is recorded.
L251 — Check if token fully paid: Compares creditedAmount against the required amount to decide whether this invoice token line is fully settled.
L283 — Cancel wipes credited accounting: cancelInvoice deletes the whole invoice record, erasing the wallet's credited-token balance with no refund to the payer.
L307 — Only exit sweeps to admin: emergencyWithdraw is the sole way tokens leave, and it sends them to the admin role — never back to the locked-out payer.

PoC#

Registry (Foundry, local deploy — verbatim vulnerable source + harm-asserting test + negative control):

BASH

cd 62849-h-02-paid-tokens-by-smart-contract-wallets-are-not-refunded_exp
forge test -vvv

The browser Playground replays the same synthetic opcode-for-opcode and measures the harm: A smart-contract wallet's partial invoice payment (40e18 tokens) is permanently locked in InvoiceManager when a SETTLER cancels the stuck in. Both gates are green (registry forge test PASS + Playground _verify-poc VERDICT: PASS).

Sources & further analysis#

Reproductions & code

No executable Forge reproduction is claimed; the historical source/toolchain was unavailable for this finding.
AuditVault finding: 62849-h-02-paid-tokens-by-smart-contract-wallets-are-not-refunded.
Upstream DeFiHackLabs PoC directory: src/test.

Alerts & third-party analyses

DeFiHackLabs incident explorer: search "Etherspot: A smart-contract wallet's partial invoice payment (40e18 tokens) is permanently locked in".
Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync