Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Sequence — partial session-signature replay / frontrun (H-02)

1. Calls.execute bumps the nonce, validates the session signature, then runs calls. 2. A later call with BEHAVIOR_REVERT_ON_ERROR reverts the entire transaction → nonce not consumed. 3. Session sigs are recovered per call index, not over the full payload. 4. Attacker trims [A,B] + [SigA,SigB] down…

Oct 2025•Other•signature•3 min read

Chain

Other

Category

signature

Date

Oct 2025

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 63761-h-02-partial-signature-replayfrontrunning-attack-on-session. Standalone Foundry PoC and full write-up: 63761-h-02-partial-signature-replayfrontrunning-attack-on-session_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/signature/partial-replay · vuln/mev/frontrun · vuln/bridge/replay · vuln/atomicity

Reproduction: self-contained Foundry PoC with only forge-std. Full trace: output.txt. PoC: test/63761-h-02-partial-signature-replayfrontrunning-attack-on-session_exp.sol.

AuditVault taxonomy: lang/solidity · platform/code4rena · has/github · has/poc · severity/high · sector/account · sector/dex · sector/staking · genome: replay · griefing · frontrun · permit-fork-replay · fot-slippage

Key info#

ImpactHIGH — multi-call session that reverts on a later BEHAVIOR_REVERT_ON_ERROR leaves per-call signatures reusable; attacker executes a prefix of the payload alone and steals funds / breaks atomicity
ProtocolSequence — Calls.sol + SessionSig.sol
Vulnerable codeNonce bumped before execution (undone on full revert) + per-call hashCallWithReplayProtection not bound to full payload
Bug classPartial signature replay / mempool frontrun of multi-call sessions
FindingCode4rena — Sequence 2025-10 · H-02 · reporter montecristo
Report2025-10-sequence
SourceAuditVault
StatusAudit finding. Local synthetic reduction of the session execute + per-call sig path.
Compiler^0.8.24 (PoC)
Repo@commitcode-423n4/2025-10-sequence@b0e5fb15

TL;DR#

  1. Calls.execute bumps the nonce, validates the session signature, then runs calls.
  2. A later call with BEHAVIOR_REVERT_ON_ERROR reverts the entire transaction → nonce not consumed.
  3. Session sigs are recovered per call index, not over the full payload.
  4. Attacker trims [A,B] + [SigA,SigB] down to [A] + [SigA] and re-submits.
  5. HARM: Call A alone transfers 100 WETH from the wallet to the attacker.

The vulnerable code#

SOLIDITY
nonce = usedNonce + 1; // @> VULN: undone if a later call reverts the tx
// ...
revert Reverted(i); // full revert → nonce unconsumed
// ...
return keccak256(abi.encodePacked(DOMAIN, space, nonce, callIdx, ...)); // @> VULN: per-call only

Fix: bind each session call signature to the complete payload hash.

Root cause#

Atomic multi-call semantics are enforced only by full-tx revert, but authorization is per-call. When the revert also rolls back nonce consumption, every proper prefix of a signed multi-call remains a valid standalone payload.

Preconditions#

  • A multi-call session payload with per-call session signatures.
  • At least one later call uses BEHAVIOR_REVERT_ON_ERROR and fails (or attacker frontruns a subset from the mempool).

Attack walkthrough#

  1. Session signs [transfer tokens to attacker, alwaysRevert] both with REVERT_ON_ERROR.
  2. Full execute reverts on call 1; nonce stays 0; wallet still funded.
  3. Attacker submits only call 0 + Sig0.
  4. Transfer succeeds; wallet drained.

Diagrams#

sequenceDiagram participant S as Session signer participant W as SessionWallet participant A as Attacker S->>W: execute A then B REVERT_ON_ERROR W-->>W: B reverts whole tx nonce unconsumed A->>W: execute only A with SigA W->>A: transfer wallet tokens

Impact#

Financial loss (partial execution of transfers/swaps), state corruption (broken atomicity), and mempool frontrun grief of legitimate multi-call sessions.

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.