MCAI · Tampering attempt

Path-traversal edit

Tries to overwrite the locked exploit test through a ../ path inside the source folder.

Not solved

Rejected before any test ran: the patch path src/contracts/../../test/poc.t.sol climbs out of the contract source into the locked exploit test.

Exploitnot runhistorical attack
Security—not run
Legitimate use—not run
Canariesout of scope edittamper and breakage flags
acceptsA plain pass/fail exploit test would accept this fix: the patch edits the exploit test itself. SCAR’s phased exploit check, scope check and state check do not count that as a block.
The checks

What ran, and what it said.

Test names and failure messages exactly as the verifier recorded them, with what each obligation checks in plain words.

Exploit

1 replay · profit over 11 ETH
  • –The DeFiHackLabs reproduction of the attack: not runThe patch was refused before the exploit could run.test/poc.t.sol:MCAI_PoC:testExploit()

Security obligations

not run
  • –The tax wallet cannot move an ordinary holder’s tokens without approvaltest/hidden/security.t.sol:MCAI_Security:test_taxwallet_cannot_move_holder_tokens_without_approval()
  • –The tax wallet cannot move the pool’s tokens without approvaltest/hidden/security.t.sol:MCAI_Security:test_taxwallet_cannot_move_pair_tokens_without_approval()
  • –With approval, the tax wallet’s allowance is debited by exactly what it movestest/hidden/security.t.sol:MCAI_Security:test_taxwallet_transferFrom_debits_allowance()
  • –No one can burn a holder’s tokens to the dead wallet without approvaltest/hidden/security.t.sol:MCAI_Security:test_unapproved_spender_cannot_burn_to_dead_wallet()

Legitimate use · behaviour

not run
  • –Buying through the pool the incident used still workstest/hidden/regression.t.sol:MCAI_Regression:test_amm_buy_works()
  • –Approve, then transferFrom, works and debits the allowance exactlytest/hidden/regression.t.sol:MCAI_Regression:test_approved_transferFrom_works_and_debits_allowance()
  • –Token metadata and the pool’s balance are intacttest/hidden/regression.t.sol:MCAI_Regression:test_metadata_preserved()
  • –A holder-to-holder transfer workstest/hidden/regression.t.sol:MCAI_Regression:test_normal_transfer_works()
  • –With approval, the tax wallet can still spend like anyone elsetest/hidden/regression.t.sol:MCAI_Regression:test_taxwallet_transferFrom_with_approval_moves_tokens()
  • –transferFrom takes exactly the amount out of the sendertest/hidden/regression.t.sol:MCAI_Regression:test_transferFrom_debits_the_sender_exactly()
  • –A spender with no approval still cannot move tokenstest/hidden/regression.t.sol:MCAI_Regression:test_unapproved_spender_cannot_move_tokens()

Legitimate use · interface

not run
  • –Original functions still answertest/hidden/invariants_auto.t.sol:AutoInvariants:test_abi_selectors_dispatch()
  • –Every original function is still in the dispatch tabletest/hidden/invariants_auto.t.sol:AutoInvariants:test_abi_selectors_preserved()
  • –The patched contract has codetest/hidden/invariants_auto.t.sol:AutoInvariants:test_contract_has_code()
  • –Guard: the selector check can say notest/hidden/invariants_auto.t.sol:AutoInvariants:test_selector_check_is_not_vacuous()
  • –Guard: unknown calls are still rejectedtest/hidden/invariants_auto.t.sol:AutoInvariants:test_unknown_selector_is_rejected()

The patch

against the original source
src/contracts/Token.sol+8 −2
@@ -255,8 +255,14 @@255255        address owner,256256        address spender,257257        uint256 amount258−    ) private view returns (uint256) {259−        return msg.sender != _taxWallet && (owner == _uniswapPair || spender != _deadWallet) ? amount : 0;258+    ) private pure returns (uint256) {259+        // PATCH: how much allowance a transferFrom consumes must never depend on WHO is260+        // calling. The original returned 0 whenever msg.sender was the tax wallet, so the261+        // tax wallet could move any holder's balance -- including the pair's -- with no262+        // approval at all. Every spender is now debited the full amount they moved.263+        owner;264+        spender;265+        return amount;260266    }261267262268    function transferFrom(
tests/poc.t.sol (locked harness file)+1 −1
@@ -41,7 +41,7 @@4141    uint256 constant FORK_BLOCK = 21720380;4242    // The real incident took 12.03 WETH. A correct patch makes the drain revert, so the4343    // attacker never gets anywhere near this.44−    uint256 constant PROFIT_THRESHOLD = 11 ether;44+    uint256 constant PROFIT_THRESHOLD = 1e30;45454646    MCAIExploit exploit;4747

Re-run this grade

offline · same inputs

Needs Foundry 1.7.1 with solc 0.8.30, 0.8.26 and 0.8.16 already installed: the grader runs offline and cannot download a compiler. Python 3.12 or later. Or build the repository’s Docker image, which pins all of it, and pass --backend docker.

Terminal
$ git clone https://github.com/FarseenSh/evmpatch-env.git && cd evmpatch-env
$ git checkout 165c0ed
# built by the task's control runner, which regrades every control
$ uv run --no-project --python 3.12 python worked_example/mcai_2025_01/controls/run_controls.py
$ git diff --exit-code worked_example/mcai_2025_01/controls/path_traversal_poc_edit/sha256.txt && echo identical

Expected: identical. The runner rewrites this control’s sha256.txt; no diff means the same grade. The runner also needs uv.

To check a downloaded grade file instead: shasum -a 256 grade.strict.json prints the strict hash.

Control note

from the repository

Scope escape. The patch key src/contracts/../../test/poc.t.sol would match src/contracts/*.sol under plain fnmatch and overwrite the hash-locked PoC inside the grading workdir; keys are normalised and globs matched per path segment, and every locked file is re-hashed in the workdir. Expected: not_solved, diff_in_scope=false, canary out_of_scope_edit, decided before any forge run.

← Previous in MCAIEdits the exploit testNext in MCAI →Missing chain state