Parallel 3.1 — processSurplus always reverts for managed collateral

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 65528-surplusprocesssurplus-always-reverts-for-managed-collateral. Standalone Foundry PoC and full write-up: 65528-surplusprocesssurplus-always-reverts-for-managed-collateral_exp in the evm-hack-registry mirror.

Vulnerability classes: frozen-funds · permanent · dos-resistance

Reproduction: self-contained Foundry PoC with only forge-std. Full trace: output.txt. PoC: test/65528-surplusprocesssurplus-always-reverts-for-managed-collateral_exp.sol.

AuditVault taxonomy: lang/solidity · sector/governance · sector/lending · sector/stable · platform/cyfrin · has/github · has/poc · severity/high · impact/dos/permanent · genome: frozen-funds · permanent · dos-resistance

Key info#

TL;DR#

1. Managed collateral lives on an external manager/strategy, never on the diamond.
2. getCollateralSurplus correctly uses manager.totalAssets().
3. processSurplus self-swaps and transferFroms from the diamond.
4. Diamond balance is 0 → transfer reverts for any positive surplus.
5. HARM: strategy yield can never be captured as distributable tokenP.

The vulnerable code#

IERC20(tokenIn).safeTransferFrom(
    msg.sender, // @> VULN: diamond has 0 managed collateral
    LibManager.transferRecipient(...),
    amountIn
);

Fix: LibManager.release surplus to the diamond before the self-swap.

Root cause#

Surplus accounting follows managed total assets, but the swap pull path assumes the diamond holds the tokens — true only for unmanaged collateral.

Preconditions#

• Collateral configured as managed (isManaged).
• Strategy has yield so surplus > 0.

Attack walkthrough#

1. Mint tokenP with managed collateral (tokens go user → manager).
2. Simulate strategy yield on the manager.
3. getCollateralSurplus reports positive surplus.
4. processSurplus reverts on transferFrom(diamond, manager, surplus).

Diagrams#

Impact#

Permanent DoS on surplus processing for managed assets — the primary surplus source (strategy yield) is uncapturable.

Sources#

• AuditVault finding #65528
• Cyfrin Parallel 3.1 v2.0
• Fix: parallel-parallelizer@2dfad62

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 65528-surplusprocesssurplus-always-reverts-for-managed-collateral_exp (evm-hack-registry mirror).
• AuditVault finding: 65528-surplusprocesssurplus-always-reverts-for-managed-collateral.

Alerts & third-party analyses

• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.