# Moonbeam, Astar, And Acala Library Truncation Bugfix Review — $1m Payout

Frontier's EVM transfer truncated msg.value from 256 to 128 bits, letting attackers mint depegged wrapped tokens and drain wrappers/DEXes on Moonbeam, Astar, Acala.

- Payout: $1,000,000
- Severity: critical
- Program: Moonbeam
- Credited: pwning.eth
- Disclosed: 2023-01-04
- Write-up quality: 8/10
- Original: https://immunefi.com/blog/bug-fix-reviews/moonbeam-astar-and-acala-library-truncation-bugfix-review-1m-payout/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-moonbeam-astar-and-acala-library-truncation-bugfix-review-1m-payout
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:evm tech:rust tech:solidity technique:chained technique:source-review vuln:business-logic vuln:precision-loss

**Target:** Frontier Substrate EVM compatibility pallet (Currency::transfer)
**Root cause:** Frontier's transfer handler cast transfer.value (256-bit U256) to u128 via low_u128(), silently truncating high bits so the runtime transfers 0 while the EVM/contract sees the full 256-bit msg.value.
**Steps:**
1. Deploy exploit contract on Moonbeam referencing the Wrapped MOVR (WMOVR) contract address.
2. Call depositWMOVR() with msg.value=0; contract computes val = 2^128 + 0 and passes it as msg.value.
3. Frontier truncates 2^128 to 0, so no MOVR is actually transferred, but WMOVR credits 2^128 deposit.
4. Call withdrawMOVR() to redeem 2^128 MOVR for only gas fees.
**How found:** Researcher audited Frontier's low-level EVM event/transfer handling and noticed the U256-to-u128 low_u128() cast in Currency::transfer, hypothesizing a mismatch between EVM-visible msg.value and actual runtime transfer.
**Exploitation:** Attacker passes msg.value of 2^128 (or any value whose low 128 bits are zero) to a wrapper contract's deposit; Frontier truncates to 0 so no native funds move, yet the wrapper mints full 256-bit amount. Withdrawing drains the wrapper's native reserves; same trick against DEXes accepting native transfers drains their liquidity.
**Escalation:** Same primitive applies across all three chains (Moonbeam, Astar, Acala) and to any DEX accepting native-token swaps, scaling potential loss to ~$200m.
**Insight:** In EVM-compatibility layers, audit every U256-to-u128/u64 cast on value/balance fields: a truncation where low bits are zero makes the runtime move nothing while contracts credit the full amount, a free-mint primitive against wrappers and DEXes.