# SIR.trading — March 2025

## 1. What happened

On **30 March 2025**, SIR.trading's Ethereum Vault was drained. The project's own retrospective reports **$355,000, its entire TVL**; Verichains and rekt.news give the same amount. These are contemporary reported USD estimates, not a fresh valuation. [Project](https://docs.sir.trading/protocol-overview/user-risks/exploit-and-relaunch.md), [Verichains](https://blog.verichains.io/p/eip-1153-transient-storage-save-gas), [Rekt](https://rekt.news/sirtrading-rekt).

SlowMist identifies the stolen assets as **17,814.8626 USDC, 1.4085 WBTC and 119.871 WETH**. Its introduction says “over $300,000,” while its fund-tracing section says approximately $300,000. These differ in precision/value from the project's $355,000; no valuation reconciliation was found. [SlowMist](https://slowmist.medium.com/fatal-residue-an-on-chain-heist-triggered-by-transient-storage-10909e4a255a).

Blockscope instead reports **over $360,000**, also naming USDC, WETH and WBTC. Its summary dates the exploit to March 30, but its detailed timeline labels events January 30, 2025. This is an internal date discrepancy; March 30 is supported by the project and both security analyses above. [Blockscope](https://research.blockscope.co/sir-protocol-exploit).

## 2. Root cause

This was a **smart-contract authorization bug**. The project's retrospective says transient slot 1 authenticated the Uniswap V3 callback caller, but was overwritten with a minted amount and left stale between operations. [Project](https://docs.sir.trading/protocol-overview/user-risks/exploit-and-relaunch.md). Verichains explains that `mint` stored the expected pool address there; the callback checked `msg.sender` against it, then reused that slot to return the minted amount. Because transient storage survives function returns until transaction completion, a later callback interpreted the amount as its authorized caller. An attacker-controlled amount could therefore masquerade as an address and bypass authorization. [Verichains](https://blog.verichains.io/p/eip-1153-transient-storage-save-gas). SlowMist emphasizes missing cleanup, while the project and Verichains also identify slot reuse; these are complementary explanations of the same lifecycle flaw, rather than conflicting causes. [SlowMist](https://slowmist.medium.com/fatal-residue-an-on-chain-heist-triggered-by-transient-storage-10909e4a255a), [Project](https://docs.sir.trading/protocol-overview/user-risks/exploit-and-relaunch.md).

## 3. Pattern

**Callback validation failure through transient-storage aliasing and stale authorization state.** Vulnerable shape: one slot holds `expectedPool`; a callback reads it as an authority; the same slot later holds `mintedAmount`; another callback in the same transaction still treats it as an authority. Data has crossed a trust boundary because its meaning changed without invalidating its authorization role. This classification follows the project's description; it is an implementation error, not evidence that Ethereum's transient-storage primitive itself malfunctioned. [Project](https://docs.sir.trading/protocol-overview/user-risks/exploit-and-relaunch.md), [Verichains](https://blog.verichains.io/p/eip-1153-transient-storage-save-gas).

## 4. The check that would have caught it

Proposed predeployment checks, derived from the documented slot reuse and transaction-wide lifetime:

1. **Same-transaction regression/invariant test:** use a harness that completes a legitimate mint and then attempts another callback before the transaction ends. Vary minted amounts and unauthorized callers, including values numerically equal to a harness caller address. Assert: a callback succeeds only during an outstanding swap and only from that swap's independently authenticated pool; after completion, every unsolicited callback reverts and Vault asset balances remain unchanged. Run the sequence in one transaction: separate transactions would automatically erase the stale slot. [Basis](https://blog.verichains.io/p/eip-1153-transient-storage-save-gas).
2. **Transient-slot lifecycle review:** enumerate every `TSTORE`/`TLOAD` and its meaning at each external-call boundary. Reject sharing a callback-authority slot with a numeric return value. Use distinct slots for those roles, and require authority to be cleared/consumed when the swap finishes. Review both normal completion and nested calls against the invariant above. This targets the exact collision and cleanup failure reported by the project. [Basis](https://docs.sir.trading/protocol-overview/user-risks/exploit-and-relaunch.md).

## 5. Sources

The project's technical retrospective was found through its documentation index. URLs read/consulted (including discovery pages and an inaccessible attempted analysis):

- https://docs.sir.trading/protocol-overview/user-risks/exploit-and-relaunch.md
- https://docs.sir.trading/llms.txt
- https://docs.sir.trading/
- https://www.sir.trading/
- https://slowmist.medium.com/fatal-residue-an-on-chain-heist-triggered-by-transient-storage-10909e4a255a
- https://blog.verichains.io/p/eip-1153-transient-storage-save-gas
- https://research.blockscope.co/sir-protocol-exploit
- https://rekt.news/sirtrading-rekt
- https://www.halborn.com/blog/post/explained-the-sir-trading-hack-march-2025 (retrieval failed; not relied on)
- https://crypto.news/defi-protocol-sir-trading-loses-entire-355k-tvl-following-exploit/ (discovery)
- https://www.blockchainbreaches.com/en/breaches/sir-trading-2025 (discovery)
- https://www.openzeppelin.com/news/web3-security-auditors-2025-rewind (search excerpt)
- https://hacked.slowmist.io/?c=&page=23 (search excerpt)