Radius Technology: Expired auth tokens are pruned from the custom group ledger but never burned from the auth

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 62866-expired-token-groups-not-synchronized-with-erc1155-balance-t. The historical source/toolchain is unavailable; this entry is documentation only and claims no executable Forge PoC.

Vulnerability classes: vuln/locked-funds · vuln/access-control

Reproduction: a faithful minimal reproduction of the vulnerable finding — the vulnerable function is reproduced verbatim (marked @>) with faithful minimal doubles; local deploy, no fork.

Root cause#

Expired auth tokens are pruned from the custom group ledger but never burned from the authoritative ERC1155 balance, so 50 phantom expired tokens remain transferable and are moved to the sink (should have been destroyed).

        }
        // If any expired groups were removed, emit an event with the total amount of expired tokens
        if (expiredAmount > 0) {
            emit ExpiredTokensBurned(account, id, expiredAmount); // @> removes expired records and emits "burned", but NEVER burns the underlying ERC1155 balance -> phantom balance stays transferable
        }
    }

Why it's exploitable here#

Expired auth tokens are pruned from the custom group ledger but never burned from the authoritative ERC1155 balance, so 50 phantom expired tokens remain transferable and are moved to the sink (should have been destroyed).

Attack path#

Marked-line walkthrough (Playground)#

The EVM Playground pins each step to the exact executed source line in 0x8ea53755a6…:

1. L57 — ERC1155 approval setter: Setup: standard setApprovalForAll on the ERC1155 auth-token contract.
2. L73 — Guard transfer against balance: Checks the sender holds enough ERC1155 balance — the authoritative ledger that the expiry logic fails to update.
3. L91 — Real burn function exists: _burn actually reduces ERC1155 balance — the call the expiry path should make but never does.
4. L125 — Load account's token groups: Reads the custom per-account _group ledger that tracks token batches and their expiry timestamps.
5. L139 — Init expired-amount accumulator: Starts expiredAmount, the counter summing how many tokens across the groups have expired.
6. L156 — Some tokens have expired: Branch taken when expiredAmount > 0 after expired entries are pruned from the group ledger.
7. L157 — Emits burn event without burning: Root cause: only emits ExpiredTokensBurned — it prunes the group ledger but never calls _burn, so phantom expired tokens stay transferable.

PoC#

Registry (Foundry, local deploy — verbatim vulnerable source + harm-asserting test + negative control):

cd 62866-expired-token-groups-not-synchronized-with-erc1155-balance-t_exp
forge test -vvv

The browser Playground replays the same synthetic opcode-for-opcode and measures the harm: Expired auth tokens are pruned from the custom group ledger but never burned from the authoritative ERC1155 balance, so 50 phantom expired t. Both gates are green (registry forge test PASS + Playground _verify-poc VERDICT: PASS).

Sources & further analysis#

Reproductions & code

• No executable Forge reproduction is claimed; the historical source/toolchain was unavailable for this finding.
• AuditVault finding: 62866-expired-token-groups-not-synchronized-with-erc1155-balance-t.
• Upstream DeFiHackLabs PoC directory: src/test.

Alerts & third-party analyses

• DeFiHackLabs incident explorer: search "Radius Technology: Expired auth tokens are pruned from the custom group ledger but never burned from the auth".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.