Ammplify — H-9: Parent borrow marks sibling but settle skips sibling mint

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 63175-h-9-liquidity-borrowed-from-or-repaid-to-parent-nodes-is-not. Standalone Foundry PoC and full write-up: 63175-h-9-liquidity-borrowed-from-or-repaid-to-parent-nodes-is-not_exp in the evm-hack-registry mirror.

Vulnerability classes: decimal-mismatch · fee-theft · price-manipulation

Reproduction: self-contained Foundry PoC with only forge-std. Full trace: output.txt.

AuditVault taxonomy: severity/high · sector/dex · platform/sherlock · fee-theft · data-corruption/price-manipulation

Key info#


Impact	HIGH — pool vs node accounting diverge; enables draining protocol balances
Protocol	Ammplify
Vulnerable code	`solveLiq` sets `sibling.preBorrow` but settle route omits sibling
Finding	#63175 / issue 424 · anonymousjoe, blockace, panprog
Compiler	`^0.8.24`

TL;DR#

Taker demand on a child forces borrow from parent.
Sibling also receives preBorrow (parent liq = both children).
Settle walks only the op route (child+parent), not sibling.
Uniswap never mints sibling liq → accounting lies; price games steal funds.

The vulnerable code#

SOLIDITY

sibling.preBorrow += borrow; // @> VULN: sibling not on settle route
sibling.dirty = true;
// FIX: second settle pass over siblings / include both children in route

Diagrams#

flowchart TD A["Borrow from parent for right child"] --> B["sibling.left preBorrow += amt"] B --> C["settle route = right + parent only"] C --> D["left never minted in pool"] D --> E["Accounting broken / drain path"]

Sources#

AuditVault #63175
Sherlock #424
Source: src/walkers/Liq.sol solveLiq

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 63175-h-9-liquidity-borrowed-from-or-repaid-to-parent-nodes-is-not_exp (evm-hack-registry mirror).
AuditVault finding: 63175-h-9-liquidity-borrowed-from-or-repaid-to-parent-nodes-is-not.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync