Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settle a large debt position for a negligible asset cost.
CVSS Details
CVSS Score
6.8
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Configurations (Affected Products)
No configuration data available.
Marginal v1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
// This is a simplified representation of the vulnerable logic
contract MarginalV1 Vulnerability {
mapping(address => uint256) public debtPosition;
// Simulating the vulnerability: Unsafe Downcast
function settleDebt() external payable {
uint256 currentDebt = debtPosition[msg.sender];
// VULNERABILITY: Direct downcast from uint256 to uint128
// If currentDebt > type(uint128).max, it wraps around to a small number
uint128 requiredPayment = uint128(currentDebt);
require(msg.value >= requiredPayment, "Payment too low");
debtPosition[msg.sender] = 0;
// Attacker clears a massive debt by paying a tiny amount
}
function borrow(uint256 amount) external {
debtPosition[msg.sender] += amount;
}
}