Bitallx · Breaks legitimate use

Payouts always revert

Every payout reverts with the message the task treats as “exploit blocked”. Nobody can be paid.

Not solved

The exploit is blocked, but a legitimate-use obligation fails: “A funded batch payout pays everyone correctly”.

Exploitblockedhistorical attack

Security3 / 3obligations pass

Legitimate use9 / 10obligations pass

Canariesbrickedtamper and breakage flags

acceptsAn exploit-only check would accept this fix. The exploit really is blocked, which is what makes it look finished. The obligations are what reject it.

The checks

What ran, and what it said.

Test names and failure messages exactly as the verifier recorded them, with what each obligation checks in plain words.

Exploit

1 replay · profit over 2,000 USDT

✓The DeFiHackLabs reproduction of the attack: blockedIt fails in the attack or profit step, for a reason the task declares.test/poc.t.sol:Bitallx_PoC:testExploit()Payout total does not match the funded amount

Security obligations

3 / 3 pass

✓A batch whose total exceeds what was funded pays nothing[0, treasury] with nothing funded: the shape a first-element-only fix lets through.test/hidden/security.t.sol:Bitallx_Security:test_multi_element_over_request_pays_nothing()
✓The incident’s own shape pays nothingA one-element over-request from a payer who funded nothing, kept as a standing obligation.test/hidden/security.t.sol:Bitallx_Security:test_single_element_over_request_from_fresh_payer_pays_nothing()
✓The sum is bounded, not just each element[total, total] funded once must not be paid twice.test/hidden/security.t.sol:Bitallx_Security:test_sum_over_funded_total_rejected_even_when_each_element_fits()

Legitimate use · behaviour

4 / 5 pass

✗A funded batch payout pays everyone correctlyThe contract’s actual purpose.test/hidden/regression.t.sol:Bitallx_Regression:test_funded_batch_payout_distributes_correctly()Payout total does not match the funded amount
✓The patched code still reads the contract’s live storageA fix that inserts or reorders state variables would re-point every one of them.test/hidden/regression.t.sol:Bitallx_Regression:test_live_storage_still_readable()
✓The owner’s treasury sweep works, and only for the ownertest/hidden/regression.t.sol:Bitallx_Regression:test_owner_treasury_path_still_works()
✓An unfunded payer is refusedtest/hidden/regression.t.sol:Bitallx_Regression:test_payout_rejects_an_unfunded_payer()
✓The publisher can still pay a reward, within its limitstest/hidden/regression.t.sol:Bitallx_Regression:test_publisher_can_still_pay_a_reward()

Legitimate use · interface

5 / 5 pass

✓Original functions still answerCalls the original functions and requires an answer other than “no such function”.test/hidden/invariants_auto.t.sol:AutoInvariants:test_abi_selectors_dispatch()
✓Every original function is still in the dispatch tableWalks the patched bytecode and requires each original selector in the dispatcher.test/hidden/invariants_auto.t.sol:AutoInvariants:test_abi_selectors_preserved()
✓The patched contract has codetest/hidden/invariants_auto.t.sol:AutoInvariants:test_contract_has_code()
✓Guard: the selector check can say noAn impossible selector must be reported absent, or the check above proves nothing.test/hidden/invariants_auto.t.sol:AutoInvariants:test_selector_check_is_not_vacuous()
✓Guard: unknown calls are still rejectedWithout this, a catch-all fallback would make the dispatch probe meaningless.test/hidden/invariants_auto.t.sol:AutoInvariants:test_unknown_selector_is_rejected()

The patch

against the original source

src/contracts/Token.sol+1 −0

@@ -91,6 +91,7 @@9191    uint256 totalSendAmount9292    ) external {9393        require(wallet.length == amount.length, "The length of 2 arrays should be the same");94+        revert("Payout total does not match the funded amount");   // VARIANT9495    9596        uint256 allowance = IBEP20(tokencontract).allowance(msg.sender, address(this));9697        require(allowance >= totalSendAmount, "Insufficient token allowance");

Re-run this grade

offline · same inputs

Needs Foundry 1.7.1 with solc 0.8.30, 0.8.26 and 0.8.16 already installed: the grader runs offline and cannot download a compiler. Python 3.12 or later. Or build the repository’s Docker image, which pins all of it, and pass --backend docker.

Terminal

$ git clone https://github.com/FarseenSh/evmpatch-env.git && cd evmpatch-env
$ git checkout 165c0ed
$ python -m evmpatch_env.sandbox tasks/bitallx_2025_05 \
    --patch worked_example/bitallx_2025_05/controls/recognised_reason__payout_always_reverts/Token.sol \
    --backend local --sha256

Expected output: core 3c743eea4cc1d02b9a39164cf121afc0ad080c14285475da00a061879796d522 and strict 63760f09fec879f86490b1e1c283f68035cafbb11ab8f89ad5cf72046c1a094d.

To check a downloaded grade file instead: shasum -a 256 grade.strict.json prints the strict hash.

Control note

from the repository

BitallxPayOut always reverts with the declared block reason: the oracle looks blocked, but nobody can be paid at all.

ReceiptNot solved

Task: bitallx_2025_05 · v2
Chain: BNB Chain · block 49,758,338
State: 79 recorded RPC responses
Schema: evmpatch.grade/1+reasons
Toolchain: forge 1.7.1 · solc 0.8.30
Source: evmpatch-env @ 165c0ed

core3c743eea4cc1d02b9a39164cf121afc0ad080c14285475da00a061879796d522

strict63760f09fec879f86490b1e1c283f68035cafbb11ab8f89ad5cf72046c1a094d

Recomputes both from the grade on this page

grade.strict.json grade.core.json full result ↗Token.sol ↗

The strict hash pins every test outcome and failure message; the core hash drops the messages, so it survives a toolchain change. A hash identifies a grade, not a patch: two fixes that grade identically share one. A compile failure, for example, carries no test evidence, so every compile failure in a case hashes the same. To check that the grade is right, re-run it.

re-run Reproduced on 23 Sep 2026 on two machines, both hashes identical: a fresh clone on the Mac that recorded it, and GitHub’s Linux CI runner.

← Previous in BitallxChecks the first amount only Next in Bitallx →Repair that shifts storage