Strata Tranches — donation-prevention gamed → withdrawals stuck

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 63224-mechanism-to-prevent-donation-attack-can-be-gamed-to-cause-w. Standalone Foundry PoC and full write-up: 63224-mechanism-to-prevent-donation-attack-can-be-gamed-to-cause-w_exp in the evm-hack-registry mirror.

Vulnerability classes: frozen-funds · donation inflation · MIN_SHARES

Reproduction: self-contained Foundry PoC, forge-std only.

AuditVault taxonomy: severity/high · sector/vault · platform/cyfrin · frozen-funds · locked-funds

Key info#


Impact	HIGH — all withdrawals revert MinSharesViolation; assets trapped in Strategy
Protocol	Strata Tranches
Vulnerable code	`_onAfterWithdrawalChecks` requires `totalSupply >= MIN_SHARES`
Bug class	Donation inflation under min-share floor
Finding	Cyfrin · Strata 2025-10-08 · #63224

TL;DR#

Donate to Strategy before first deposit → first mint is 1 wei of shares. Later large deposits still leave totalSupply < MIN_SHARES. Every withdraw reverts; capital stuck.

The vulnerable code#

SOLIDITY

if (totalSupply < MIN_SHARES) revert MinSharesViolation(); // @> VULN
// FIX: seed dead shares / sweep donations before enabling deposits

Diagrams#

sequenceDiagram participant Attacker participant Strategy participant Tranche participant Victim Attacker->>Strategy: donate 1e18 Attacker->>Tranche: deposit 1.1e18 Note over Tranche: mints 1 wei share Victim->>Tranche: deposit 1e6 Note over Tranche: totalSupply still under MIN_SHARES Victim->>Tranche: withdraw Tranche-->>Victim: MinSharesViolation

Impact#

User-deposited assets cannot be withdrawn from Strategy.

Sources#

AuditVault #63224
Cyfrin Strata
Fixed: Strata-Money/contracts-tranches@f344885

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 63224-mechanism-to-prevent-donation-attack-can-be-gamed-to-cause-w_exp (evm-hack-registry mirror).
AuditVault finding: 63224-mechanism-to-prevent-donation-attack-can-be-gamed-to-cause-w.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync