Submitted by roccomania, also found by 0xN3x, 0xrex, 10ap17, 4th05, audityourcontracts, Bobai23, Breeje, BroRUok, ChainProof, crunter, cryptomoon, d3e4, dd0x7e8, falconhoof, franfran20, frndz0ne, givn, HalalAudits, heheboii, hgrano, hl_, Ikigai, immeas, Kalogerone, KannAudits, kazan, leegh, limmmmmeeee, mahdifa, merlin, moray5554, Mylifechangefast_eth, Pelz, phaseTwo, phoenixV110, Sancybars, seeques, SpicyMeatball, steadyman, t0x1c, Timeless, tusharr1411, Uddercover, VAD37, Weed0607, y4y, and zarkk01
https://github.com/code-423n4/2025-03-nudgexyz/blob/main/src/campaign/NudgeCampaign.sol#L164-L233
https://github.com/code-423n4/2025-03-nudgexyz/blob/main/src/campaign/NudgeCampaign.sol#L308-L321
The NudgeCampaign::handleReallocation function allows any attacker to manipulate reward allocations through flash loans or repeated calls with real fund via Li.Fis executor. This can lead to reward depletion and disruption of legitimate user rewards even after invalidating the attacker
The vulnerability stems from two main issues:
The invalidateParticipations function only subtracts from pendingRewards but doesnt return the fees to the claimable pool, creating a growing discrepancy in reward accounting.
Here is a test to prove this. This was run in mainnet fork. Since this will be deployed on Ethereum and other L2s in from the doc. Create a new test file and add this to the test suite src/test/NudgeCampaignAttackTest.t.sol.
Then run with forge test --mt test_attackReallocationTest -vvv. Here is the result:
This vulnerability allows attackers to:
The attack could be executed at minimal cost and would be difficult to detect until rewards are significantly depleted.
Foundry
Fix reward accounting:
raphael (Nudge.xyz) confirmed
