GROKD Reward Drain

This is an attack-class accounting flaw in staking exit logic. The vulnerable component is the staking implementation behind proxy 0x6e30..., specifically forceExit() (selector 0x67acc704) executed through delegatecall. Trace evidence shows one stake(...) call and then 50 forceExit() calls, each transferring the same HPAY amount from proxy treasury to attacker executor. The stake state is initialized during stake, but no corresponding state-consumption pattern is observed during repeated exits; instead, withdrawals keep succeeding until pool balance is depleted. This violates the invariant that cumulative exit payout for an account must not exceed recorded principal. Because the function is publicly callable and requires no privileged keys, any unprivileged actor can realize the opportunity when pool liquidity exists.

4. Detailed Root Cause Analysis

The exploit mechanism is fully observable in a single transaction trace:

0xBe189f...::stake(1197944982325549072340425) [delegatecall]   // 1 time
0xBe189f...::forceExit() [delegatecall]                          // 50 times

Trace also shows the stake-position storage write on stake:

@ 0xfa485f000aae286e8df2ef850d48a6ed4147dd9dd894d02c294a211452ed475f:
  0 -> 0x00000000000000000000000000000000000000000000f899e9bea7bd720f5931

Then each forceExit() performs the same payout-sized HPAY transfer:

HedgeToken::transfer(0x0dc0c0e040cadcc3855fa347daa192bc5fc9d6e8,
                     1173986082679038090893617)
emit Transfer(src: 0x6E30..., dst: 0x0dc0..., wad: 1173986082679038090893617)

Observed invariant break:

• Expected: after full exit, remaining withdrawable principal for the caller should be zero.
• Actual: 50 successful exits occur after one stake, each paying the same principal-sized amount.

Measured outcome from balance diffs:

• Victim proxy HPAY delta: -57525318051272866453787233.
• Attacker EOA native delta: +26014028087022048755 wei (net after gas).

Exploit conditions (ACT-realizable):

• Attacker can source initial HPAY (flash borrow suffices).
• Proxy holds enough HPAY balance.
• forceExit() is publicly reachable and does not enforce one-time principal consumption.

Security principles violated:

• Withdrawal state must be consumed atomically with value transfer.
• Exit paths must cap cumulative payouts to recorded stake.
• Upgradeable staking logic must preserve accounting invariants under repeated calls.

5. Adversary Flow Analysis

Transaction: 0x5f2ea6cb43d14986188fa2f474d9e22502fa95cc76cab72cd6ba1ba146ed137f (BSC 56, block 83268463).

1. Flash borrow and setup

• EOA 0x734e1bda62e779878f6c6f9f42d793badf247244 initiates exploit deployment/execution (0xcabba5..., 0x0dc0...).
• Executor receives HPAY via pair callback path from 0xf603....

2. Stake once, exit repeatedly

• Executor stakes 1197944982325549072340425 HPAY via proxy.
• Executor calls proxy fallback forceExit() 50 times (delegatecall into 0xBe189f...).
• Each call transfers 1173986082679038090893617 HPAY from proxy to executor.

3. Unwind and realize profit

• Executor swaps drained HPAY via router 0x10ed43c718714eb63d5aa57b78b54704e256024e.
• WBNB unwrap and native transfer send proceeds back to EOA.
• Trace shows terminal transfer amount 26014224201105944931 wei before fee accounting; net native delta at EOA is 26014028087022048755 wei.

Adversary-related accounts:

• 0x734e1bda62e779878f6c6f9f42d793badf247244 (EOA sender and profit recipient)
• 0xcabba5f0d9911d46010d50a0f6d8bafa2b019114 (orchestrator contract)
• 0x0dc0c0e040cadcc3855fa347daa192bc5fc9d6e8 (primary exploit executor)

6. Impact & Losses

Primary deterministic loss:

• Token: HPAY (0xc75aa1fa199eac5adabc832ea4522cff6dfd521a)
• Victim: staking proxy 0x6e30c17d2554dca5a1ac178939764c6bf61ab95a
• Amount drained: 57525318051272866453787233 HPAY units

Profit realization:

• Net attacker-native gain at sender EOA: 26014028087022048755 wei BNB (after gas).

7. References

• Exploit tx: 0x5f2ea6cb43d14986188fa2f474d9e22502fa95cc76cab72cd6ba1ba146ed137f
• Trace artifact (call flow, delegatecalls, storage/balance transitions): artifacts/collector/seed/56/0x5f2ea6cb43d14986188fa2f474d9e22502fa95cc76cab72cd6ba1ba146ed137f/trace.cast.log
• Balance diff artifact (native + ERC20 deltas): artifacts/collector/seed/56/0x5f2ea6cb43d14986188fa2f474d9e22502fa95cc76cab72cd6ba1ba146ed137f/balance_diff.json
• Metadata artifact (tx/block envelope): artifacts/collector/seed/56/0x5f2ea6cb43d14986188fa2f474d9e22502fa95cc76cab72cd6ba1ba146ed137f/metadata.json
• Root cause source JSON: root_cause.json