Accountable: A partially-filled redeem controller re-requests; the never-decremented request.totalValue

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 62971-partial-redemptions-can-be-used-to-steal-assets-cyfrin-none. The historical source/toolchain is unavailable; this entry is documentation only and claims no executable Forge PoC.

Vulnerability classes: vuln/theft · vuln/locked-funds · vuln/unfair-mint · vuln/price

Reproduction: a faithful minimal reproduction of the vulnerable finding — the vulnerable function is reproduced verbatim (marked @>) with faithful minimal doubles; local deploy, no fork.

Root cause#

A partially-filled redeem controller re-requests; the never-decremented request.totalValue inflates the averaged request.sharePrice, crediting ~500 assets for 200 shares worth 400 at true price 2, letting the controller drain the ~100 surplus base-assets from the pooled vault to the attacker EOA.

        if (remainingShares == 0) {
            _delete(controller, requestId);
        } else {
            _queue.requests[requestId].shares = remainingShares; // @> totalValue is NOT decremented here — it stays inflated after a partial fill
        } // @audit the totalValue is not updated here.
    }

Why it's exploitable here#

A partially-filled redeem controller re-requests; the never-decremented request.totalValue inflates the averaged request.sharePrice, crediting ~500 assets for 200 shares worth 400 at true price 2, letting the controller drain the ~100 surplus base-assets from the pooled vault to the attacker EOA.

Attack path#

Marked-line walkthrough (Playground)#

The EVM Playground pins each step to the exact executed source line in 0x671d353a77…:

1. L40 — Token name field: Setup: declares the vault token's public name.
2. L44 — Share balances mapping: Setup: standard balanceOf mapping for vault shares.
3. L124 — Submit redeem request: requestRedeem records a controller's shares and price; re-calling it on a partial fill re-averages the stored price.
4. L145 — Branch on request-price mode: Selects the RequestPrice path where the request's own sharePrice governs the payout.
5. L171 — Reduce request by filled shares: _reduce computes remainingShares left after a partial fulfillment of the redeem request.
6. L184 — Shares decremented, value kept: Root cause: writes back remainingShares but never decrements request.totalValue, so a re-request inflates the averaged sharePrice.
7. L197 — Transfer surplus assets out: Pays asset to the recipient — the step that drains the ~100 surplus base-assets to the attacker.

PoC#

Registry (Foundry, local deploy — verbatim vulnerable source + harm-asserting test + negative control):

cd 62971-partial-redemptions-can-be-used-to-steal-assets-cyfrin-none_exp
forge test -vvv

The browser Playground replays the same synthetic opcode-for-opcode and measures the harm: A partially-filled redeem controller re-requests; the never-decremented request.totalValue inflates the averaged request.sharePrice, crediti. Both gates are green (registry forge test PASS + Playground _verify-poc VERDICT: PASS).

Sources & further analysis#

Reproductions & code

• No executable Forge reproduction is claimed; the historical source/toolchain was unavailable for this finding.
• AuditVault finding: 62971-partial-redemptions-can-be-used-to-steal-assets-cyfrin-none.
• Upstream DeFiHackLabs PoC directory: src/test.

Alerts & third-party analyses

• DeFiHackLabs incident explorer: search "Accountable: A partially-filled redeem controller re-requests; the never-decremented request.totalValue".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.