Read the accounting and the reward math

Graduate · enrolled learners

This lesson opens with Popsicle Finance, August 2021.

What happened

Popsicle Finance's Sorbetto Fragola vaults tracked how much reward each user was entitled to, based on the position tokens they held. But the accounting did not properly update a user's reward entitlement when they transferred their position tokens to another address, so a user could move the same position tokens from wallet to wallet and, at each wallet, still appear entitled to rewards the position had already earned. An attacker exploited exactly this, transferring the same position tokens across multiple addresses and repeatedly claiming rewards they were not owed, draining about 20 million dollars. Nothing was broken cryptographically; the flaw was in the reward accounting, the bookkeeping that was supposed to move a position's earned-reward record along with the position when it changed hands and did not. The gap was readable by tracing how the contract credited rewards and asking whether that credit was correctly updated when a position token moved, and the answer, that it was not, was the whole exploit.

The decision point

A contract's accounting, the bookkeeping by which it tracks who is owed what and updates that record on deposits, withdrawals, transfers, and claims, is code that can be read, and value leaks whenever the bookkeeping fails to update on an action that should change it. Popsicle Finance is the case: its reward accounting did not update a position's earned-reward entitlement when the position token was transferred, so an attacker moved the same position across wallets and claimed the same rewards repeatedly, draining about 20 million dollars, all through a gap that was readable by tracing how rewards were credited on transfer. This is the third reading skill of the course, and it is harder than reading control or transfer behavior because it requires following the bookkeeping: what the contract records about each user, when that record is updated, and whether every action that should change it actually does. The dangerous case is an action that moves value or entitlement but leaves the accounting stale, a transfer that does not carry the reward record, a deposit that does not reset a counter, a claim that does not mark the reward as taken, because a stale record lets someone claim what they are no longer owed or claim it twice. So the discipline is to trace the accounting on every value-changing action, asking whether the record of who-is-owed-what is correctly updated each time, and to treat a contract whose bookkeeping does not update on an action that should change it as a contract that leaks, because Popsicle is what a reward entitlement that failed to follow a transfer becomes when someone traces it and realizes the same position can be paid again and again.

Recorded loss

$20,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.