StakeDAO's Votemarket exploited for $175k due to flawed sender validation logic in cross-chain message handling that remained undetected for 17 months.
Security & Exploits ·
StakeDAO's Votemarket sustained a $175,000 exploit on March 12 stemming from flawed sender validation in its cross-chain message handling. According to the incident disclosure, the vulnerability had persisted undetected in production for approximately 17 months, having been introduced on October 21, 2024.
The flaw lay in the L1BlockOracleUpdater.receiveMessage() function's authorization logic. The conditional check used AND operators across three conditions: chainId != 1, sender != L1_SENDER, and sender != address(this). When chainId equaled 1 (Ethereum mainnet), the first operand evaluated false, causing the entire expression to short-circuit without triggering the revert. This meant any address could send cross-chain messages from mainnet through LaPoste and bypass the sender authorization entirely.
The exploit underscores a critical gap in testing and code review practices, particularly for logic governing cross-chain authentication. Details regarding remediation steps, affected user recovery, or whether additional vulnerabilities were discovered remain unclear from the available disclosure.