Reproduced Exploit
Strata Tranches — withdrawal active requests DoS'd by malicious users
Anyone can call transfer(..., victim, 1 wei) and inflate the victim's request array. finalize iterates all entries → OOG after ~35k spam (shown via sample×extrapolate).
Chain
Other
Category
untagged
Date
Oct 2025
Source
AuditVault
EVM Playground
Source-level debugger — step opcodes and Solidity in sync
The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.
Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 63223-users-can-get-their-withdrawal-active-requests-dosed-by-mali. Standalone Foundry PoC and full write-up: 63223-users-can-get-their-withdrawal-active-requests-dosed-by-mali_exp in the
evm-hack-registrymirror.
Vulnerability classes: griefing · unbounded-loop · missing access control
Reproduction: self-contained Foundry PoC (sample+extrapolate gas). forge-std only.
AuditVault taxonomy: severity/high · sector/staking · platform/cyfrin · griefing · unbounded-loop · dos-resistance
Key info#
| Impact | HIGH — victim finalize() OOGs; USDe unstake stuck |
| Protocol | Strata Tranches · UnstakeCooldown |
| Vulnerable code | UnstakeCooldown.transfer pushes to any to without ACL |
| Bug class | Missing access control + unbounded finalize loop |
| Finding | Cyfrin · Strata 2025-10-08 · #63223 |
TL;DR#
Anyone can call transfer(..., victim, 1 wei) and inflate the victim's request array. finalize iterates all entries → OOG after ~35k spam (shown via sample×extrapolate).
The vulnerable code#
requestsOf[to].push(...); // @> VULN: no access control
// FIX: ACL + soft/hard request limits
Diagrams#
Impact#
Victim cannot complete USDe unstake while spam requests remain.
Sources#
Sources & further analysis#
Reproductions & code
- Standalone PoC + full trace: 63223-users-can-get-their-withdrawal-active-requests-dosed-by-mali_exp (evm-hack-registry mirror).
- AuditVault finding: 63223-users-can-get-their-withdrawal-active-requests-dosed-by-mali.
Alerts & third-party analyses
These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.