# HenloKart: fake native deposit and immediate cancel drains ETH

HenloKart's ETH transfer helper allowed zero-value native deposits funded from contract balance, and inverted cancel lock let attacker immediately cancel and drain 0.59 ETH.

- Payout: Real-world hack
- Severity: high
- Program: HenloKart
- Credited: DeFiHackLabs
- Disclosed: 2025-02-26
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-02/HenloKart_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250226-henlokart
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** HenloKart race commitment contract on Base
**Root cause:** ETH transfer helper treated `from == msg.sender` as permission to send ETH from the contract balance instead of requiring msg.value; cancel lock check was inverted, allowing immediate cancellation.
**Steps:**
1. Call `commitToRace(address(this), HISTORICAL_AGENT, address(0), 0, 0.01 ether, 0, 59)` with zero msg.value; contract funds the 0.01 ETH bet from its own balance.
2. Immediately call `cancelCommitment(commitmentHash)`; inverted lock check permits cancellation, returning the fake deposit to attacker.
3. Repeat or scale to drain contract ETH balance (0.59 ETH total).
**How found:** Likely code review of the ETH transfer helper and cancel lock logic, spotting that `from == msg.sender` bypassed msg.value requirement and that the lock check was inverted.
**Exploitation:** Attacker deployed a contract that called commitToRace with zero msg.value, causing the contract to treat the caller as the source and send its own ETH as the bet. The attacker then immediately canceled the commitment, receiving the ETH back. Repeated to drain 0.59 ETH.
**Insight:** In native-token deposit functions, always verify msg.value equals the intended amount; never trust a `from` parameter to imply funds were sent. Also audit boolean lock conditions for inversion.