Reproduced Exploit

Strata Tranches — withdrawal active requests DoS'd by malicious users

Anyone can call transfer(..., victim, 1 wei) and inflate the victim's request array. finalize iterates all entries → OOG after ~35k spam (shown via sample×extrapolate).

Oct 2025Otheruntagged2 min read

Chain

Other

Category

untagged

Date

Oct 2025

Source

AuditVault

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 63223-users-can-get-their-withdrawal-active-requests-dosed-by-mali. Standalone Foundry PoC and full write-up: 63223-users-can-get-their-withdrawal-active-requests-dosed-by-mali_exp in the evm-hack-registry mirror.


Vulnerability classes: griefing · unbounded-loop · missing access control

Reproduction: self-contained Foundry PoC (sample+extrapolate gas). forge-std only.

AuditVault taxonomy: severity/high · sector/staking · platform/cyfrin · griefing · unbounded-loop · dos-resistance


Key info#

ImpactHIGH — victim finalize() OOGs; USDe unstake stuck
ProtocolStrata Tranches · UnstakeCooldown
Vulnerable codeUnstakeCooldown.transfer pushes to any to without ACL
Bug classMissing access control + unbounded finalize loop
FindingCyfrin · Strata 2025-10-08 · #63223

TL;DR#

Anyone can call transfer(..., victim, 1 wei) and inflate the victim's request array. finalize iterates all entries → OOG after ~35k spam (shown via sample×extrapolate).

The vulnerable code#

SOLIDITY
requestsOf[to].push(...); // @> VULN: no access control
// FIX: ACL + soft/hard request limits

Diagrams#

flowchart TD A["Attacker spam transfer 1 wei to victim"] --> B["requestsOf victim grows"] B --> C["finalize iterates all"] C --> D{"gas greater than block limit?"} D -->|yes| E["DoS: funds stuck"]

Impact#

Victim cannot complete USDe unstake while spam requests remain.

Sources#


Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.