Reproduced Exploit
Super DCA — H-4: Bucket rewards wiped by stake/unstake before accrue
After rewards accrue on a bucket, any stake/unstake resets lastRewardIndex to current rewardIndex. Subsequent accrueReward sees delta 0 → paid = 0.
Chain
Other
Category
untagged
Date
Sep 2025
Source
AuditVault
EVM Playground
Source-level debugger — step opcodes and Solidity in sync
The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.
Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 63422-h-4-bucket-rewards-will-be-wiped-by-stakeunstake-before-accr. Standalone Foundry PoC and full write-up: 63422-h-4-bucket-rewards-will-be-wiped-by-stakeunstake-before-accr_exp in the
evm-hack-registrymirror.
Vulnerability classes: state-update · reward-theft · reward-accounting
Reproduction: self-contained Foundry PoC, forge-std only.
AuditVault taxonomy: severity/high · sector/staking · platform/sherlock · state-update · reward-accounting
Key info#
| Impact | HIGH — up to 100% of pending bucket rewards lost |
| Protocol | SuperDCAStaking |
| Vulnerable code | unstake sets lastRewardIndex = rewardIndex without settling |
| Bug class | Index reset without accrual |
| Finding | Sherlock · 2025-09-super-dca · #63422 |
TL;DR#
After rewards accrue on a bucket, any stake/unstake resets lastRewardIndex to current rewardIndex. Subsequent accrueReward sees delta 0 → paid = 0.
The vulnerable code#
info.lastRewardIndex = rewardIndex; // @> VULN in unstake/stake
// FIX: settle pending bucket rewards first
Diagrams#
Impact#
Stakers lose accrued rewards whenever stake/unstake races before gauge settlement.
Sources#
- AuditVault #63422
- Sherlock 2025-09-super-dca #1065
- Fix: Super-DCA-Tech/super-dca-gauge#41
Sources & further analysis#
Reproductions & code
- Standalone PoC + full trace: 63422-h-4-bucket-rewards-will-be-wiped-by-stakeunstake-before-accr_exp (evm-hack-registry mirror).
- AuditVault finding: 63422-h-4-bucket-rewards-will-be-wiped-by-stakeunstake-before-accr.
Alerts & third-party analyses
These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.