Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Recall — [H-05] Incorrect supply fund transferral in leave()

leave() pays genesisBalance as ETH collateral instead of supply ERC20 — drains other validators

Feb 2025•Other•untagged•2 min read

Chain

Other

Category

untagged

Date

Feb 2025

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 65092-h-05-incorrect-supply-fund-transferral-in-function-leave-can. Standalone Foundry PoC and full write-up: 65092-h-05-incorrect-supply-fund-transferral-in-function-leave-can_exp in the evm-hack-registry mirror.

Vulnerability classes: severity/high · platform/code4rena · sector/staking · sector/governance

Reproduction: self-contained Foundry PoC with only forge-std — no fork, no RPC. Full trace: output.txt.

AuditVault taxonomy: lang/solidity · platform/code4rena · has/poc · severity/high · protocol Recall

Key info#

ImpactHIGH — leave() pays genesisBalance as ETH collateral instead of supply ERC20 — drains other validators
ProtocolRecall (IPC / subnet actor)
FindingCode4rena 2025-02-recall · #65092
Report2025-02-recall
SourceAuditVault
Compiler^0.8.24 (PoC)

TL;DR#

leave() pays genesisBalance as ETH collateral instead of supply ERC20 — drains other validators

The vulnerable code#

SOLIDITY
collateralSource.transferFunds(payable(msg.sender), genesisBal); // @> VULN

Fix: Use supplySource.transferFunds for genesis refunds (as preRelease does).

Root cause#

See vulnerable line above. Reduced synthetic preserves the blamed statement verbatim (@> VULN).

Preconditions#

  • Audited Recall / IPC contracts at contest commit ab5f90b9.
  • Attack path as described in the Code4rena report.

Attack walkthrough#

  1. Deploy the synthetic vulnerable surface.
  2. Execute the attack in Exploit.run().
  3. Assert the report's concrete harm (funds / liveness / forged consensus).

Diagrams#

flowchart TD A["Attacker crafts inputs"] --> B["Vulnerable function executes"] B --> C{"Bug condition?"} C -- "yes" --> D["HARM: leave() pays genesisBalance as ETH collateral instead of supply ERC20 — drains other validators"] C -- "no" --> E["Would be safe if fixed"]
sequenceDiagram participant A as Attacker participant V as Vulnerable participant S as State A->>V: trigger V->>S: bad update Note over V: @> VULN line S-->>A: harm realized

Remediation#

Use supplySource.transferFunds for genesis refunds (as preRelease does).

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.