{"id":25237211,"url":"https://github.com/rappie/echidna-rari-hack","last_synced_at":"2025-10-20T07:37:30.841Z","repository":{"id":178983913,"uuid":"662641063","full_name":"rappie/echidna-rari-hack","owner":"rappie","description":"Reproduction of the $80M Rari Finance Hack on April 30 2022 using on-chain fuzzing with Echidna","archived":false,"fork":false,"pushed_at":"2024-06-16T16:02:53.000Z","size":24,"stargazers_count":13,"open_issues_count":0,"forks_count":4,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-11T15:46:50.104Z","etag":null,"topics":["echidna","evm","fuzzing","hack","solidity"],"latest_commit_sha":null,"homepage":"","language":"Solidity","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rappie.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-07-05T15:06:54.000Z","updated_at":"2025-01-25T22:24:47.000Z","dependencies_parsed_at":null,"dependency_job_id":"1a7fd9e4-4250-4517-98ff-b66a329585c9","html_url":"https://github.com/rappie/echidna-rari-hack","commit_stats":null,"previous_names":["rappie/echidna-rari-hack"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rappie%2Fechidna-rari-hack","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rappie%2Fechidna-rari-hack/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rappie%2Fechidna-rari-hack/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rappie%2Fechidna-rari-hack/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rappie","download_url":"https://codeload.github.com/rappie/echidna-rari-hack/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":241513220,"owners_count":19974710,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["echidna","evm","fuzzing","hack","solidity"],"created_at":"2025-02-11T15:33:38.890Z","updated_at":"2025-10-20T07:37:30.754Z","avatar_url":"https://github.com/rappie.png","language":"Solidity","funding_links":[],"categories":["Practical Code Samples"],"sub_categories":["Utils"],"readme":"# Reproduction of Rari Finance hack\n\n## Description\nThis is a reproduction of the $80M Rari Finance hack on April 30 2022, using on-chain fuzzing with Echidna.\n\nWe're using a single invariant which checks if an actor is able to increase their balance by an unreasonably large amount. We have a basic set of functions such as `mint`, `borrow` and `exitMarket`, etc. Since the hack involves reentrancy, we've implemented rudementary reentrancy support in [EchidnaReentrancy](src/echidna/EchidnaReentrancy.sol).\n\nAfter running for approximately 30 minutes (1 worker), we can detect a significant increase in funds for the attacking actor. The shrunk sequence can be seen below.\n\n```\ntestProfit(): failed!💥\n  Call sequence:\n    setReentrancyEnabled(true)\n    mint(5,10089325332519370949262917519849428342404732088146691233195543578618300570336)\n    setReentrancyCallback(4)\n    borrow(2,1164710473815707741)\n    redeem(2,995200615491)\n    testProfit()\n\nEvent sequence:\n    Panic(1): Using assert\n    Debug(«account0Profit», 0) from: 0xa329c0648769a73afac7f9381e08fb43dbea72\n    Debug(«account1Profit», 1002263350696681541) from: 0xa329c0648769a73afac7f9381e08fb43dbea72\n    Debug(«account2Profit», 0) from: 0xa329c0648769a73afac7f9381e08fb43dbea72\n\n```\n\n## Links\n- https://twitter.com/BlockSecTeam/status/1520350965274386433\n- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/c4564f5ad21783cb81969540b57b07dd12e53b2a/src/test/Rari_exp.t.sol\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frappie%2Fechidna-rari-hack","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frappie%2Fechidna-rari-hack","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frappie%2Fechidna-rari-hack/lists"}