Accountable: A RequestPrice redeemer who locked a 100-asset guarantee at request-time price (1e18) is s

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 62972-accountableasyncredeemvaultfulfillredeemrequest-ignores-proc. The historical source/toolchain is unavailable; this entry is documentation only and claims no executable Forge PoC.

Vulnerability classes: vuln/locked-funds · vuln/price

Reproduction: a faithful minimal reproduction of the vulnerable finding — the vulnerable function is reproduced verbatim (marked @>) with faithful minimal doubles; local deploy, no fork.

Root cause#

A RequestPrice redeemer who locked a 100-asset guarantee at request-time price (1e18) is settled at the lower fulfilment-time price (0.5e18) and paid only 50 assets, losing 50 that stay retained in the vault for the remaining holders.

SOLIDITY


// ─────────────────────────────────────────────────────────────────────────────
// VULNERABLE vault. fulfillRedeemRequest body is VERBATIM from the finding:
// it passes sharePrice() (the CURRENT price) instead of the stored request price.
// ─────────────────────────────────────────────────────────────────────────────
contract AccountableAsyncRedeemVault is AccountableAsyncRedeemVaultBase {

Why it's exploitable here#

Attack path#

flowchart TD S0["Return current share price"] S1["Assign new request ID"] S2["Record pending shares"] S3["Reduce fulfilled request"] S4["Abstract fulfill declaration"] H["A RequestPrice redeemer who locked a 100-asset guarantee at request-ti"] S0 --> S1 S1 --> S2 S2 --> S3 S3 --> S4 S4 --> H

Marked-line walkthrough (Playground)#

The EVM Playground pins each step to the exact executed source line in 0x671d353a77…:

L119 — Return current share price: Returns the vault's live _currentSharePrice — the fulfilment-time price wrongly used to settle request-price redeems.
L132 — Assign new request ID: Increments _nextRequestId to tag a fresh redeem request.
L144 — Record pending shares: Adds the caller's shares to pendingShares when a redeem request is opened.
L155 — Reduce fulfilled request: _reduce decrements a controller's request as its shares get fulfilled.
L167 — Abstract fulfill declaration: Declares the virtual fulfillRedeemRequest that concrete strategies must implement.
L171 — Read request-time locked price: Returns the request's stored sharePrice — the 1e18 guarantee that fulfilment ignores when the market price drops.
L195 — Fulfill ignores locked price: Root cause: this fulfillRedeemRequest settles at fulfilment-time price instead of the request's locked price, underpaying the redeemer 50 assets.

PoC#

Registry (Foundry, local deploy — verbatim vulnerable source + harm-asserting test + negative control):

BASH

cd 62972-accountableasyncredeemvaultfulfillredeemrequest-ignores-proc_exp
forge test -vvv

The browser Playground replays the same synthetic opcode-for-opcode and measures the harm: A RequestPrice redeemer who locked a 100-asset guarantee at request-time price (1e18) is settled at the lower fulfilment-time price (0.5e18). Both gates are green (registry forge test PASS + Playground _verify-poc VERDICT: PASS).

Sources & further analysis#

Reproductions & code

No executable Forge reproduction is claimed; the historical source/toolchain was unavailable for this finding.
AuditVault finding: 62972-accountableasyncredeemvaultfulfillredeemrequest-ignores-proc.
Upstream DeFiHackLabs PoC directory: src/test.

Alerts & third-party analyses

DeFiHackLabs incident explorer: search "Accountable: A RequestPrice redeemer who locked a 100-asset guarantee at request-time price (1e18) is s".
Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync