GTE — Distributor addRewards with fake quoteToken drains real rewards

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 64854-h-06-donations-to-distributor-with-arbitrary-quotetoken-can. Standalone Foundry PoC and full write-up: 64854-h-06-donations-to-distributor-with-arbitrary-quotetoken-can_exp in the evm-hack-registry mirror.

Vulnerability classes: missing-validation · direct-drain · reward-theft

Reproduction: self-contained Foundry PoC with only forge-std. Full trace: output.txt. PoC: test/64854-h-06-donations-to-distributor-with-arbitrary-quotetoken-can_exp.sol.

AuditVault taxonomy: lang/solidity · platform/code4rena · has/github · has/poc · severity/high · sector/dex · sector/launchpad · genome: direct-drain · reward-theft · reward-accounting

Key info#

TL;DR#

1. addRewards(launch, fake, 0, amount) accepts any token1.
2. Fake transferFrom succeeds; pendingQuoteRewards inflates.
3. Claims pay the registered real quote token.
4. HARM: attacker with stake drains real USDC rewards.

The vulnerable code#

if (quoteAssetAmount > 0) {
    rs.addQuoteRewards(launchAsset, quoteAsset, quoteAssetAmount); // @> VULN: quoteAsset unvalidated
    quoteAsset.safeTransferFrom(msg.sender, address(this), uint256(quoteAssetAmount));
}

Fix: require provided quote equals the pool's registered quoteAsset.

Root cause#

Accounting updates use the caller-supplied quote address; payouts use storage rs.quoteAsset.

Preconditions#

• Existing reward pool with stakers and real quote inventory.
• Attacker holds some shares.

Attack walkthrough#

1. Stake a small share.
2. addRewards with malicious token1 and large amount1.
3. claimRewards → receive real quote.

Diagrams#

Impact#

Theft of distributor quote balances; can brick further claims for honest stakers.

Sources#

• AuditVault: https://github.com/Auditware/AuditVault/blob/main/findings/64854-h-06-donations-to-distributor-with-arbitrary-quotetoken-can.md
• Report: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad
• Repo@commit: https://github.com/code-423n4/2025-08-gte-perps/blob/f43e1eedb65e7e0327cfaf4d7608a37d85d2fae7/contracts/launchpad/Distributor.sol#L106-L132

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 64854-h-06-donations-to-distributor-with-arbitrary-quotetoken-can_exp (evm-hack-registry mirror).
• AuditVault finding: 64854-h-06-donations-to-distributor-with-arbitrary-quotetoken-can.

Alerts & third-party analyses

• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.