Recall — [H-04] Overflow count of messages in bottom-up batch

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 65091-h-04-an-attacker-can-overflow-the-count-of-messages-in-a-bot. Standalone Foundry PoC and full write-up: 65091-h-04-an-attacker-can-overflow-the-count-of-messages-in-a-bot_exp in the evm-hack-registry mirror.

Vulnerability classes: severity/high · platform/code4rena · sector/staking · sector/governance

Reproduction: self-contained Foundry PoC with only forge-std — no fork, no RPC. Full trace: output.txt.

AuditVault taxonomy: lang/solidity · platform/code4rena · has/poc · severity/high · protocol Recall

Key info#


Impact	HIGH — Overpopulated cut batch permanently fails ensureValidCheckpoint — bottom-up halt
Protocol	Recall (IPC / subnet actor)
Finding	Code4rena 2025-02-recall · #65091
Report	2025-02-recall
Source	AuditVault
Compiler	`^0.8.24` (PoC)

TL;DR#

Overpopulated cut batch permanently fails ensureValidCheckpoint — bottom-up halt

The vulnerable code#

SOLIDITY

b.msgs.push(batch.msgs[i]); // @> VULN: push without max-size check

Fix: Enforce maxMsgsPerBottomUpBatch on every push into a cut batch.

Root cause#

See vulnerable line above. Reduced synthetic preserves the blamed statement verbatim (@> VULN).

Preconditions#

Audited Recall / IPC contracts at contest commit ab5f90b9.
Attack path as described in the Code4rena report.

Attack walkthrough#

Deploy the synthetic vulnerable surface.
Execute the attack in Exploit.run().
Assert the report's concrete harm (funds / liveness / forged consensus).

Diagrams#

flowchart TD A["Attacker crafts inputs"] --> B["Vulnerable function executes"] B --> C{"Bug condition?"} C -- "yes" --> D["HARM: Overpopulated cut batch permanently fails ensureValidCheckpoint — bottom-up halt"] C -- "no" --> E["Would be safe if fixed"]

sequenceDiagram participant A as Attacker participant V as Vulnerable participant S as State A->>V: trigger V->>S: bad update Note over V: @> VULN line S-->>A: harm realized

Remediation#

Enforce maxMsgsPerBottomUpBatch on every push into a cut batch.

Sources#

AuditVault finding
Code4rena report 2025-02-recall
Reduced source: code-423n4/2025-02-recall@ab5f90b9

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 65091-h-04-an-attacker-can-overflow-the-count-of-messages-in-a-bot_exp (evm-hack-registry mirror).
AuditVault finding: 65091-h-04-an-attacker-can-overflow-the-count-of-messages-in-a-bot.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync