Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Ammplify — H-7: `collectFees` re-targets original `asset.liq` after `adjustMaker`

1. newMaker stores asset.liq = 300e18. 2. adjustMaker sets live liq to 100e18 but leaves asset.liq unchanged. 3. collectFees re-targets to asset.liq → position snaps back to 300e18. 4. User who expected fee-only collection is re-exposed (or may brick if diamond underfunded).

Sep 2025•Other•untagged•2 min read

Chain

Other

Category

untagged

Date

Sep 2025

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 63173-h-7-makercollectfees-re-targets-liquidity-to-original-amount. Standalone Foundry PoC and full write-up: 63173-h-7-makercollectfees-re-targets-liquidity-to-original-amount_exp in the evm-hack-registry mirror.

Vulnerability classes: decimal-mismatch · fee-theft · cross-contract-state-consistency

Reproduction: self-contained Foundry PoC with only forge-std. Full trace: output.txt.

AuditVault taxonomy: severity/high · sector/dex · platform/sherlock · fee-theft · cross-contract-state-consistency

Key info#

ImpactHIGH — position size jumps on fee collection; IL / unexpected exposure
ProtocolAmmplify
Vulnerable codeMaker.collectFees targets asset.liq never updated by adjustMaker
Finding#63173 / issue 421 · panprog (+ many)
StatusFixed in itos-finance/Ammplify PR #31
Compiler^0.8.24

TL;DR#

  1. newMaker stores asset.liq = 300e18.
  2. adjustMaker sets live liq to 100e18 but leaves asset.liq unchanged.
  3. collectFees re-targets to asset.liq → position snaps back to 300e18.
  4. User who expected fee-only collection is re-exposed (or may brick if diamond underfunded).

The vulnerable code#

SOLIDITY
// We collect simply by targeting the original liq balance.
uint128 target = a.liq; // @> VULN: original amount; adjustMaker never updated asset.liq
// FIX: a.liq = targetLiq in adjustMaker; collect uses live target

Diagrams#

flowchart LR A["newMaker liq=300"] --> B["adjustMaker live=100 asset.liq=300"] B --> C["collectFees targets asset.liq"] C --> D["live jumps 100 to 300"] D --> E["Unexpected IL / exposure"]

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.