Crypto Trainingblogweb3 security engineering
<- Back to hacks

Reproduced Exploit

Majority Protocol — start without ranked rewards locks prize pool

FixedRanksReward.setRankedRewards (and ProportionalToXPReward.setNumberOfWinners) require Created state, but the game can start and conclude without them. claimRewards then reverts RankedRewardsNotSet and tokens cannot be recovered.

Jan 2026•Other•untagged•2 min read

Chain

Other

Category

untagged

Date

Jan 2026

Source

AuditVault

PoC & write-upPoC for your local evm-hack-analyzerAuditVault PoCs

EVM Playground

Source-level debugger — step opcodes and Solidity in sync

evm-hack-analyzer

The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.

Loading fork state…

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 65377-impossible-to-claim-rewards-when-ranked-rewards-or-number-of. Standalone Foundry PoC and full write-up: 65377-impossible-to-claim-rewards-when-ranked-rewards-or-number-of_exp in the evm-hack-registry mirror.

Reproduction: self-contained Foundry PoC (forge-std only) — no fork. Full trace: output.txt.

AuditVault taxonomy: lang/solidity · platform/cyfrin · sector/gaming · severity/high · genome: frozen-funds · permanent · reward-accounting

Key info#

ImpactHIGH — prize pool permanently locked if ranked rewards / number of winners never set before start
ProtocolMajority Protocol
Bug classstartAndRevealGameQuestion does not require rewardsConfigured
FindingCyfrin (Dacian) · #65377
Reporthttps://github.com/solodit/solodit_content/blob/main/reports/Cyfrin/2026-01-27-cyfrin-majority-protocol-v2.0.md
SourceAuditVault
StatusAudit finding — reproduced as a standalone local synthetic
Compiler^0.8.24 (PoC)

TL;DR#

FixedRanksReward.setRankedRewards (and ProportionalToXPReward.setNumberOfWinners) require Created state, but the game can start and conclude without them. claimRewards then reverts RankedRewardsNotSet and tokens cannot be recovered.

HARM: 10 USDC prize pool locked in SessionManager forever.

Root cause#

No rewardsConfigured gate on startAndRevealGameQuestion.

Preconditions#

Game created with FixedRanksReward strategy; creator never calls setRankedRewards.

Attack walkthrough#

  1. Create + join without setting ranked rewards.
  2. Start → end → conclude with a winner.
  3. setRankedRewards now reverts (not Created).
  4. claimRewards reverts RankedRewardsNotSet.

Diagrams#

sequenceDiagram participant C as Creator participant SM as SessionManager participant R as FixedRanksReward participant W as Winner C->>SM: createGame no setRankedRewards C->>SM: startAndRevealGameQuestion Note over SM: Ongoing without rewards config C->>SM: endGame concludeGame W->>SM: claimRewards SM->>R: getReward R-->>W: revert RankedRewardsNotSet

Impact#

All entry fees / prize funds permanently unclaimable once Concluded.

Sources#

Sources & further analysis#

Reproductions & code

Alerts & third-party analyses

  • Web3Sec X hacked database: search.
  • Rekt leaderboard: search.
  • Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.