Skip to content

drlvaultv3

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

drlvaultv3

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
README.md
README.md
 
 
drlvaultv3.t.sol
drlvaultv3.t.sol
 
 

README.md

LumosKit Run Report — ethereum 0xe3eab35b…15c475

Deterministic final report assembled from existing LumosKit outputs; this finalize step does not call an agent.

Case overview

  • Chain: ethereum (chain_id=1)
  • Tx hash: 0xe3eab35b288c086afa9b86a97ab93c7bb61d21b1951a156d2a8f6f5d5715c475
  • Block: 23769387
  • Final quality: pass
  • Product/PoC gate: pass
  • Final-quality basis: poc_and_rca
  • Final-quality reason: Verified economic PoC and complete RCA.
  • Elapsed: 526.91s (526910 ms)
  • Finding: Public DRLVaultV3 swap uses a manipulable live Uniswap quote to spend vault USDC

Signal context

  • Protocol claim: DRLVaultV3
  • Detector source: manual-real-tx-test
  • Detected at: 2026-06-13T14:46:17.314965+00:00

Pipeline timing

  • Orchestrator wall time: 292.96s (292958 ms)

  • Current stage-duration sum: 526.91s (526910 ms)

Stage Artifact Duration Status
cefg cefg 111.17s (111170 ms) success
localize localize 16 ms success
lift lift 30 ms success
flow_context flow_context 21.26s (21264 ms) success
enrich enrich 10.67s (10672 ms) success
semantic semantic 30 ms success
context_pack context_pack 30 ms success
asset_delta asset_delta 51 ms success
poc_sketch poc_sketch 47 ms success
agent_poc agent_poc 90.64s (90642 ms) success
rca rca 292.96s (292958 ms) success

Reproduction quality

  • PoC status: verified
  • Forge fmt: pass
  • Forge build: pass
  • Forge test: pass
  • Proof kind: economic_proof
  • RCA status: complete / complete
  • RCA confidence: high

Economic reproduction

  • Basis: holder-net USD loss
  • Verdict: close — PoC reproduces the incident within the 80–110% net-loss band.
  • Incident net loss: $99977.45
  • PoC net reproduced: $94074.52
  • USD ratio: 0.941x

Attack narrative

Attack Flow

Generated by agent_poc from deterministic PoC handoff, verified Foundry execution, and economic reproduction artifacts.

Verification Gate

  • Status: pass
  • Execution status: pass
  • Economic status: pass
  • Proof kind: economic_proof
  • Forge build: pass
  • Forge test: pass

Replay Target

  • Transaction: 0xe3eab35b288c086afa9b86a97ab93c7bb61d21b1951a156d2a8f6f5d5715c475
  • Block: 23769387
  • Root call type: CALL
  • Target/tx.to: 0xe08d97e151473a848c3d9ca3f323cb720472d015
  • Attacker: 0xc0ffeebabe5d496b2dde509f9fa189c25cf29671

Observed Trace Flow

  • Ordered by trace evidence line from full CEFG; use this to place PoC constructor, entry, callback, and fallback bodies.
  • [01] line=294 frame 1 attacker_entry:NotYoink@0xe08d…d015 --CALL--> frame 2 external:entry@0xbbbb…ffcb [localized_to_external]
  • [02] line=1591 frame 2 external:entry@0xbbbb…ffcb --CALL--> frame 5 attacker_callback:onMorphoFlashLoan@0xe08d…d015 [external_callback_to_localized]
  • PoC hint: implement the target selector/fallback as a callback surface; it is entered by an external protocol frame, not direct user calldata.
  • [03] line=1776 frame 5 attacker_callback:onMorphoFlashLoan@0xe08d…d015 --CALL--> frame 6 external:entry@0xa0b8…eb48 [localized_to_external]
  • [04] line=2244 frame 5 attacker_callback:onMorphoFlashLoan@0xe08d…d015 --CALL--> frame 8 external:entry@0x2e1d…8764 [localized_to_external]
  • [05] line=925431 frame 8 external:entry@0x2e1d…8764 --CALL--> frame 30 attacker_callback:0x00000000@0xe08d…d015 [external_callback_to_localized]
  • PoC hint: implement the target selector/fallback as a callback surface; it is entered by an external protocol frame, not direct user calldata.
  • [06] line=926093 frame 5 attacker_callback:onMorphoFlashLoan@0xe08d…d015 --CALL--> frame 32 external:entry@0x6a06…f5e8 [localized_to_external]
  • [07] line=947738 frame 5 attacker_callback:onMorphoFlashLoan@0xe08d…d015 --CALL--> frame 64 external:entry@0xf680…2b08 [localized_to_external]
  • [08] line=1873983 frame 5 attacker_callback:onMorphoFlashLoan@0xe08d…d015 --CALL--> frame 83 external:entry@0xc02a…6cc2 [localized_to_external]
  • [09] line=1874175 frame 5 attacker_callback:onMorphoFlashLoan@0xe08d…d015 --CALL--> frame 84 external:entry@0xe055…939f [localized_to_external]
  • [10] line=1882856 frame 84 external:entry@0xe055…939f --CALL--> frame 88 attacker_callback:uniswapV3SwapCallback@0xe08d…d015 [external_callback_to_localized]
  • PoC hint: implement the target selector/fallback as a callback surface; it is entered by an external protocol frame, not direct user calldata.
  • [11] line=1883041 frame 88 attacker_callback:uniswapV3SwapCallback@0xe08d…d015 --CALL--> frame 89 external:entry@0xc02a…6cc2 [localized_to_external]
  • [12] line=1884038 frame 5 attacker_callback:onMorphoFlashLoan@0xe08d…d015 --CALL--> frame 91 external:entry@0xa0b8…eb48 [localized_to_external]
  • [13] line=1885883 frame 1 attacker_entry:NotYoink@0xe08d…d015 --CALL--> frame 95 external:entry@0x4838…5f97 [localized_to_external]
  • [14] line=1885894 frame 1 attacker_entry:NotYoink@0xe08d…d015 --CALL--> frame 96 external:entry@0xc0ff…9671 [localized_to_external]

PoC Surfaces

Role Surface Selector Address Frames
attacker_callback unknown 0x00000000 0xe08d97e151473a848c3d9ca3f323cb720472d015 30
attacker_callback onMorphoFlashLoan(uint256,bytes) 0x31f57072 0xe08d97e151473a848c3d9ca3f323cb720472d015 5
attacker_entry NotYoink() 0x8cbf8566 0xe08d97e151473a848c3d9ca3f323cb720472d015 1
attacker_callback uniswapV3SwapCallback(int256,int256,bytes) 0xfa461e33 0xe08d97e151473a848c3d9ca3f323cb720472d015 88

Economic Effect

  • Reconciliation basis: incident_drain
  • Verdict: close
  • Comparison basis: holder_net_usd_loss
Source Direction Holder Token Delta USD value
incident_drain loss `0x6a06707ab339bee00c6663db17ddb422301ff5

… truncated in final report; see source artifact for full text.

Multi-leg reconciliation

  • Status: pass
  • Basis: incident_drain
  • Source: agent_poc.economic_reproduction
  • Selected rows: 1
Source Direction Holder Role Token Delta USD value
incident_drain loss 0x6a06707ab339bee00c6663db17ddb422301ff5e8 storage_contract USDC -100000 $-99977.45

Root cause analysis

  • Title: Public DRLVaultV3 swap uses a manipulable live Uniswap quote to spend vault USDC
  • Severity: critical
  • Confidence: high
  • Violated invariant: Vault principal may only be swapped by authorized vault control flow, and minimum output for vault principal swaps must be based on an unmanipulated owner/operator bound or independent oracle rather than the same live spot path being traded.

Final root cause

DRLVaultV3 exposes swapToWETH(uint256) as public, with no owner/operator authorization, and lets any caller spend the vault's token balance through the configured swap router. The function computes amountOutMinimum from getQuoteForUSDC, which calls the live Uniswap V3 QuoterV2 path for the same pool after the attacker has moved the spot price. The attacker therefore forces the vault to swap 100000 USDC at the manipulated quote and then unwinds the pool for ETH profit.

Affected contracts

Address Name Role Implementation
0x6a06707ab339bee00c6663db17ddb422301ff5e8 DRLVaultV3 primary vulnerable vault clone/storage contract 0x8aa6b0e10bd6dbaf5159967f92f2e740afe2b4c3
0x8aa6b0e10bd6dbaf5159967f92f2e740afe2b4c3 DRLVaultV3 implementation code executed by frame 33 —

Recommended fixes

  • Add onlyOwner or onlyOperator to DRLVaultV3.swapToWETH at DRLVaultV3.sol:616 so arbitrary callers cannot spend vault principal.
  • Replace the same-pool live quote used at DRLVaultV3.sol:634-637 with an owner/operator supplied amountOutMinimum or an independent TWAP/oracle-backed bound.
  • Keep public quote helpers read-only or mark operational swap helpers internal when they are only intended to support privileged liquidity-management flows.

Artifacts

Artifact Bundle path Status
Bundle index README.md generated
Machine run summary report/run_summary.json generated
Final integrated report report/REPORT.md generated
RCA report/RCA.md included
RCA structured report report/report.json included
PoC poc/PoC.t.sol included
PoC base support poc/LumosPoCBase.sol included
Asset deltas evidence/asset_deltas.json included
Fund flows evidence/fund_flows.json included
Asset delta graph visuals/asset_deltas.png included
Fund-flow graph visuals/fund_flows.png included