Majority Protocol — re-join after leave permanently locks second entry fee

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 65375-impossible-for-user-to-get-refund-after-re-joining-a-resched. Standalone Foundry PoC and full write-up: 65375-impossible-for-user-to-get-refund-after-re-joining-a-resched_exp in the evm-hack-registry mirror.

Reproduction: self-contained Foundry PoC (forge-std only) — no fork. Full trace: output.txt.

AuditVault taxonomy: lang/solidity · platform/cyfrin · sector/gaming · severity/high · genome: frozen-funds · locked-funds · dos-resistance

Key info#


Impact	HIGH — second entry fee permanently locked after leave/rejoin then cancel
Protocol	Majority Protocol
Bug class	hasRefunded not cleared on re-join / rejoin allowed after refund
Finding	Cyfrin (Dacian) · #65375
Report	https://github.com/solodit/solodit_content/blob/main/reports/Cyfrin/2026-01-27-cyfrin-majority-protocol-v2.0.md
Source	AuditVault
Status	Audit finding — reproduced as a standalone local synthetic
Compiler	`^0.8.24` (PoC)

TL;DR#

After leaveRescheduledGame sets hasRefunded[gameId][player]=true, _payEntryFee on re-join never clears that flag. When the game is later cancelled, refundCancelledGame reverts AlreadyRefunded and the second fee stays in SessionManager forever.

HARM: 10 USDC stuck in SessionManager; player cannot recover the re-join fee.

Root cause#

hasRefunded is sticky across re-joins; _payEntryFee does not reset it.

Preconditions#

Game is rescheduled so leave is allowed; player leaves (refunded), re-joins, then game is cancelled.

Attack walkthrough#

Join, reschedule, leave (refund + hasRefunded=true).
Re-join (pays again; flag still true).
Cancel; refund reverts AlreadyRefunded.
Second fee locked.

Diagrams#

sequenceDiagram participant U as User participant SM as SessionManager U->>SM: joinGame Note over SM: rescheduleGame U->>SM: leaveRescheduledGame Note over SM: hasRefunded true U->>SM: joinGame again Note over SM: fee paid flag still true Note over SM: cancelGame U->>SM: refundCancelledGame SM-->>U: revert AlreadyRefunded

Impact#

User funds permanently locked in the immutable SessionManager.

Sources#

AuditVault finding
Report: https://github.com/solodit/solodit_content/blob/main/reports/Cyfrin/2026-01-27-cyfrin-majority-protocol-v2.0.md
Reduced source provenance: Engage-Protocol/engage-protocol @ cca0cb3; fixed in 3ac5654

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 65375-impossible-for-user-to-get-refund-after-re-joining-a-resched_exp (evm-hack-registry mirror).
AuditVault finding: 65375-impossible-for-user-to-get-refund-after-re-joining-a-resched.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync