Reproduced Exploit
GTE — free LP mint when accrued launchpad fees are non-zero
1. Reserves = balances − fees. 2. mint without transfer sees amount = fees → free LP. 3. Burn cashes out the free share of pool assets. 4. HARM: both tokens stolen with zero deposit.
Chain
Other
Category
untagged
Date
Aug 2025
Source
AuditVault
EVM Playground
Source-level debugger — step opcodes and Solidity in sync
The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.
Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 64853-h-05-gtelaunchpadv2pair-permits-minting-lp-tokens-for-free-w. Standalone Foundry PoC and full write-up: 64853-h-05-gtelaunchpadv2pair-permits-minting-lp-tokens-for-free-w_exp in the
evm-hack-registrymirror.
Vulnerability classes: fee-calculation · direct-drain · fee-accounting
Reproduction: self-contained Foundry PoC with only
forge-std. Full trace: output.txt. PoC: test/64853-h-05-gtelaunchpadv2pair-permits-minting-lp-tokens-for-free-w_exp.sol.
AuditVault taxonomy: lang/solidity · platform/code4rena · has/github · has/poc · severity/high · sector/dex · sector/launchpad · genome: fee-calculation · direct-drain · fee-accounting
Key info#
| Impact | HIGH — free LP then burn drains pair assets |
| Protocol | GTE |
| Vulnerable code | GTELaunchpadV2Pair.mint amount0/1 = balance − reserve |
| Bug class | Fee-inclusive deposit measurement |
| Finding | Code4rena 2025-08 GTE · #64853 · H-05 · AvantGard |
| Report | Code4rena report |
| Source | AuditVault |
| Compiler | ^0.8.24 (PoC) |
TL;DR#
- Reserves = balances − fees.
mintwithout transfer sees amount = fees → free LP.- Burn cashes out the free share of pool assets.
- HARM: both tokens stolen with zero deposit.
The vulnerable code#
uint256 amount0 = balance0.sub(_reserve0); // @> VULN
uint256 amount1 = balance1.sub(_reserve1); // @> VULN
Fix: subtract accrued launchpad fees from the measured amounts.
Root cause#
Deposit delta equals fee residual when the caller transferred nothing.
Preconditions#
- Non-zero fees on both sides (or enough on one side after min with the other).
- Same-block fee retention.
Attack walkthrough#
- Seed pool with fees on both tokens.
- Call
mintwith no pre-transfer → free LP. - Burn free LP → extract tokens.
Diagrams#
Impact#
Drain of pair liquidity proportional to free LP minted; repeatable same-block.
Sources#
- AuditVault: https://github.com/Auditware/AuditVault/blob/main/findings/64853-h-05-gtelaunchpadv2pair-permits-minting-lp-tokens-for-free-w.md
- Report: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad
- Repo@commit: https://github.com/code-423n4/2025-08-gte-perps/blob/f43e1eedb65e7e0327cfaf4d7608a37d85d2fae7/contracts/launchpad/uniswap/GTELaunchpadV2Pair.sol#L187-L188
Sources & further analysis#
Reproductions & code
- Standalone PoC + full trace: 64853-h-05-gtelaunchpadv2pair-permits-minting-lp-tokens-for-free-w_exp (evm-hack-registry mirror).
- AuditVault finding: 64853-h-05-gtelaunchpadv2pair-permits-minting-lp-tokens-for-free-w.
Alerts & third-party analyses
These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.