Reproduced Exploit
GTE — DOS graduation via 1-wei donation + sync
1. Donate 1 wei quote to empty pair and sync(). 2. Reserves become one-sided (0, >0). 3. UniswapV2Library.quote requires both reserves > 0 → reverts. 4. HARM: graduation DOS.
Chain
Other
Category
untagged
Date
Aug 2025
Source
AuditVault
EVM Playground
Source-level debugger — step opcodes and Solidity in sync
The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.
Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 64857-h-09-dos-of-launchpad-graduation-via-addliquidity-with-1-wei. Standalone Foundry PoC and full write-up: 64857-h-09-dos-of-launchpad-graduation-via-addliquidity-with-1-wei_exp in the
evm-hack-registrymirror.
Vulnerability classes: frontrun · dos-resistance · frozen-funds
Reproduction: self-contained Foundry PoC with only
forge-std. Full trace: output.txt. PoC: test/64857-h-09-dos-of-launchpad-graduation-via-addliquidity-with-1-wei_exp.sol.
AuditVault taxonomy: lang/solidity · platform/code4rena · has/github · has/poc · severity/high · sector/dex · sector/launchpad · genome: frontrun · dos-resistance · frozen-funds
Key info#
| Impact | HIGH — temporary DOS of token graduation |
| Protocol | GTE |
| Vulnerable code | _graduate → router addLiquidity → quote |
| Bug class | One-sided reserves break quote |
| Finding | Code4rena 2025-08 GTE · #64857 · H-09 · levantequarini |
| Report | Code4rena report |
| Source | AuditVault |
| Compiler | ^0.8.24 (PoC) |
TL;DR#
- Donate 1 wei quote to empty pair and
sync(). - Reserves become one-sided
(0, >0). UniswapV2Library.quoterequires both reserves > 0 → reverts.- HARM: graduation DOS.
The vulnerable code#
require(reserveA > 0 && reserveB > 0, "UniswapV2Library: INSUFFICIENT_LIQUIDITY"); // @> VULN path
Fix: if either reserve is 0, bypass router and pair.mint() directly.
Root cause#
Graduation assumes empty pair (first mint) but attacker can create one-sided reserves first.
Preconditions#
- Target pair exists (or is creatable) before graduation liquidity is added.
- Attacker can transfer 1 wei + call sync.
Attack walkthrough#
- Transfer 1 wei quote to pair;
sync(). - Call graduation / addLiquidity path.
quotereverts → graduation fails.
Diagrams#
Impact#
Denial of launchpad graduation until reserves are corrected.
Sources#
- AuditVault: https://github.com/Auditware/AuditVault/blob/main/findings/64857-h-09-dos-of-launchpad-graduation-via-addliquidity-with-1-wei.md
- Report: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad
- Repo@commit: https://github.com/code-423n4/2025-08-gte-perps/blob/f43e1eedb65e7e0327cfaf4d7608a37d85d2fae7/contracts/launchpad/Launchpad.sol#L500
Sources & further analysis#
Reproductions & code
- Standalone PoC + full trace: 64857-h-09-dos-of-launchpad-graduation-via-addliquidity-with-1-wei_exp (evm-hack-registry mirror).
- AuditVault finding: 64857-h-09-dos-of-launchpad-graduation-via-addliquidity-with-1-wei.
Alerts & third-party analyses
These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.