Majority Protocol — start without XPTiers yields zero unclaimable rewards

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 65378-impossible-to-claim-rewards-when-xptiers-are-not-set-resulti. Standalone Foundry PoC and full write-up: 65378-impossible-to-claim-rewards-when-xptiers-are-not-set-resulti_exp in the evm-hack-registry mirror.

Reproduction: self-contained Foundry PoC (forge-std only) — no fork. Full trace: output.txt.

AuditVault taxonomy: lang/solidity · platform/cyfrin · sector/gaming · severity/high · genome: frozen-funds · permanent · timestamp-dependence

Key info#


Impact	HIGH — without XP tiers, proportional rewards are zero and claim reverts; prize pool locked
Protocol	Majority Protocol
Bug class	startAndRevealGameQuestion does not require XP tiers
Finding	Cyfrin (Dacian) · #65378
Report	https://github.com/solodit/solodit_content/blob/main/reports/Cyfrin/2026-01-27-cyfrin-majority-protocol-v2.0.md
Source	AuditVault
Status	Audit finding — reproduced as a standalone local synthetic
Compiler	`^0.8.24` (PoC)

TL;DR#

setXPTiers is only allowed in Created, but the game can start without tiers. XP computation yields 0; ProportionalToXPReward then produces zero rewards and _distributeRewards reverts NoRewardAvailable — funds locked after Concluded.

HARM: 10 USDC prize pool locked; winner receives nothing.

Root cause#

No XP-tiers configured check on game start.

Preconditions#

ProportionalToXPReward path; creator sets numberOfWinners but not XP tiers.

Attack walkthrough#

Create game, set numberOfWinners, skip setXPTiers.
Start (allowed), record results with zero XP, conclude.
setXPTiers now fails; claimRewards reverts NoRewardAvailable.

Diagrams#

sequenceDiagram participant C as Creator participant SM as SessionManager participant DS as DefaultSession participant W as Winner C->>SM: createGame no setXPTiers C->>SM: startAndRevealGameQuestion Note over DS: XP tiers empty C->>DS: recordResults XP equals 0 W->>SM: claimRewards SM-->>W: revert NoRewardAvailable

Impact#

Prize funds permanently unclaimable for ProportionalToXP games started without tiers.

Sources#

AuditVault finding
Report: https://github.com/solodit/solodit_content/blob/main/reports/Cyfrin/2026-01-27-cyfrin-majority-protocol-v2.0.md
Reduced source provenance: Engage-Protocol/engage-protocol @ cca0cb3; fixed in 65727de

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 65378-impossible-to-claim-rewards-when-xptiers-are-not-set-resulti_exp (evm-hack-registry mirror).
AuditVault finding: 65378-impossible-to-claim-rewards-when-xptiers-are-not-set-resulti.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync