Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Majority Protocol — refundCancelledGame missing join check

SessionManager.refundCancelledGame only checks that the game is Cancelled, then refunds ticketPrice to msg.sender without verifying contestants[gameId][msg.sender]. An attacker who never joined can drain the entire cancelled-game pool; legitimate players then cannot refund.

Jan 2026•Other•untagged•2 min read

Chain

Other

Category

untagged

Date

Jan 2026

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 65373-attacker-can-drain-all-tokens-from-cancelled-game-since-sess. Standalone Foundry PoC and full write-up: 65373-attacker-can-drain-all-tokens-from-cancelled-game-since-sess_exp in the evm-hack-registry mirror.

Reproduction: self-contained Foundry PoC (forge-std only) — no fork. Full trace: output.txt.

AuditVault taxonomy: lang/solidity · platform/cyfrin · sector/gaming · severity/high · genome: missing · direct-drain · timestamp-dependence

Key info#

ImpactHIGH — any cancelled game can be drained of entry fees by a permissionless attacker who never joined
ProtocolMajority Protocol (Engage / Majestic Games)
Bug classMissing join check on refundCancelledGame
FindingCyfrin (Dacian) · #65373 · 2026-01-27 majority-protocol-v2.0
Reporthttps://github.com/solodit/solodit_content/blob/main/reports/Cyfrin/2026-01-27-cyfrin-majority-protocol-v2.0.md
SourceAuditVault
StatusAudit finding — reproduced as a standalone local synthetic
Compiler^0.8.24 (PoC)

TL;DR#

SessionManager.refundCancelledGame only checks that the game is Cancelled, then refunds ticketPrice to msg.sender without verifying contestants[gameId][msg.sender]. An attacker who never joined can drain the entire cancelled-game pool; legitimate players then cannot refund.

HARM: attacker receives all deposited entry fees (10 USDC in the PoC); victim refund reverts NotEnoughFunds.

Root cause#

_refundEntryFee pays whoever calls; refundCancelledGame never gates on join status.

Preconditions#

A game has at least one paying contestant and is cancelled by the creator.

Attack walkthrough#

  1. Victim joins and pays the entry fee.
  2. Creator cancels the game.
  3. Attacker (never joined) calls refundCancelledGame and receives ticketPrice.
  4. Victim's refund reverts because the pool is empty.

Diagrams#

sequenceDiagram participant V as Victim participant SM as SessionManager participant A as Attacker V->>SM: joinGame pays ticketPrice Note over SM: cancelGame A->>SM: refundCancelledGame Note over SM: no contestants check SM-->>A: ticketPrice drained V->>SM: refundCancelledGame SM-->>V: revert NotEnoughFunds

Impact#

Permissionless drain of every cancelled game's entry-fee balance.

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.