Reproduced Exploit
Linea TokenBridge upgrade — permissionless reinitialization drains locks
Replacing an inherited initializer changes the storage layout. The live bridge appears uninitialized, letting an arbitrary caller become admin, install an attacker message service, and execute completeBridging for all locked tokens.
Chain
Other
Category
access-control
Date
Mar 2026
Source
AuditVault
EVM Playground
Source-level debugger — step opcodes and Solidity in sync
The attack is replayed in an in-browser EVM preloaded with the exact dumped fork state. The execution tree shows every call; step by Solidity line or by opcode across all depths — source, Stack, Memory, Storage, Balances (native / ERC-20 / NFT), Transient storage and Return value stay in sync. Click a tree node, opcode, or source line to jump. No backend, no live RPC.
Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 65618-after-the-upgrade-permissionless-attacker-can-fully-drain-th. Standalone Foundry PoC and full write-up: 65618-after-the-upgrade-permissionless-attacker-can-fully-drain-th_exp in the
evm-hack-registrymirror.
Vulnerability classes: vuln/access-control/uninitialized-proxy · vuln/access-control/missing-auth
Key info#
| Field | Value |
|---|---|
| Loss | All locked ERC20 funds are transferred to attacker |
| Chain | Local synthetic |
TL;DR#
Replacing an inherited initializer changes the storage layout. The live bridge appears uninitialized, letting an arbitrary caller become admin, install an attacker message service, and execute completeBridging for all locked tokens.
The vulnerable code#
initialized = true; // @> VULN: the changed inheritance layout makes this live bridge appear uninitialized after upgrade.
Attack walkthrough#
The PoC seeds 1000 tokens in the bridge, initializes it as attacker, installs a malicious message service, and drains all 1000 tokens through the messaging-only completion path.
Diagrams#
Remediation#
Preserve Initializable storage across upgrades, use a safe reinitializer where needed, and validate storage layout before deployment.
Sources#
Sources & further analysis#
Reproductions & code
- Standalone PoC + full trace: 65618-after-the-upgrade-permissionless-attacker-can-fully-drain-th_exp (evm-hack-registry mirror).
- AuditVault finding: 65618-after-the-upgrade-permissionless-attacker-can-fully-drain-th.
Alerts & third-party analyses
These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.