Description
Summary
When attempting to exit an integrated DeFi Yield Vault (Beefy/Morpho) that had accumulated contaminated funds, the PPOI (Private Proofs of Innocence) defense mechanism triggered a block. Executing the UI's recommended "Safely unshield to origin" feature caused the protocol to identify RAILGUN's own Relay/Broadcaster Contract (0xFA7093CDD...) as the "origin address." Consequently, 50,551 USDC was unshielded directly back into the Relay Adapt contract, leaving the funds locked on-chain with a Missing ❌ PPOI status and zero UI trace in the wallet.
Environment
App Version: Railway Windows Desktop Wallet (Latest)
Chain: Ethereum Mainnet
Integrated Protocol: Beefy / Morpho Yield Vaults (USDC Clearstar 3Jane V2, USDC Steakhouse Reservoir V2)
Affected Contract: RAILGUN: Relay / Relay Adapt (0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9)
Sequence of Events & Cross-Wallet Proof
Initial Clean Deposit:
Initial shield on Aug-15-2026 10:48:47 AM UTC possessed a 100% valid PPOI status (Valid ✅).
DeFi Vault Contamination:
Deposited funds into Railway’s natively integrated Beefy/Morpho yield vaults.
Due to external 3rd-party liquidity entering these public yield vaults, the resulting yield shares became contaminated upstream.
Cross-Wallet Deadlock (Proving Platform-Wide Issue):
Wallet A (Test): Deposited ~50 USDC into Clearstar 3Jane Vault. Redeem triggered a PPOI block.
Wallet B (Main): Deposited 50,551 USDC into Steakhouse Reservoir Vault. Redeem triggered an identical PPOI block on an entirely separate seed phrase.
Emergency Routing Logic Failure:
Navigated to Activity -> View pending balance -> Restricted and clicked "Safely unshield to origin".
The SDK erroneously set the destination origin as the Railgun Relay Contract itself (0xFA70...4b9).
The transaction succeeded on-chain, but the funds were transferred into RAILGUN's Relay Contract rather than the user's public EOA.
Root Cause Analysis
PPOI Mechanism Overreaction: Valid user deposits were tainted after interaction with native DeFi pools due to aggregated vault liquidity.
Fallback Route Invalidation: The "Unshield to origin" feature incorrectly parsed the Relay/Broadcaster contract as the original fund source (or fallback target) instead of the user's actual underlying EOA/0zk balance.
State Loss: The fallback unshield transaction lacks a standard zero-knowledge proof generation step, resulting in a Missing ❌ status in the PPOI Lookup Tool and leaving the wallet UI unable to recognize or recover the balance.
On-Chain Evidence & Transaction Log
Wallet A ($50 Test Wallet)
Shield Tx: 0x8e0a0d92be13bb62e11aa7c149b4ac9498143b29c83b1a8f6e4060f96c613446
Status: Shield Valid ✅ | Unshield Valid ✅
Redeem Tx: 0x88595cb2b05aa066512292e3484838bd322d83e17aef05da55e95a9ff765a185
Status: Shield Blocked 🚫 | Unshield Valid ✅
Wallet B ($50,000+ Main Wallet)
Shield Tx: 0xefd5ae64954fd55cc11fe71d7ee9e543175ea205644791ed4d44e4fd4c3d0e7c
Status: Shield Valid ✅ | Unshield Valid ✅
Redeem Tx: 0x319af79f60b841d04819dd588eb6ade93675454de7f23bdf6d665b05af1b4e35
Status: Shield Blocked 🚫 | Unshield Valid ✅
Fallback Unshield to Origin Tx: 0x7f7b9b625adbdc076e314981acc58ddcdfffb7f77a84e4ca821210adcf9387ac
Status: Unshield Missing ❌ (Funds currently held in Relay Adapt Contract)
Requested Action
Manual Contract Release: Inspect transaction 0x7f7b...87ac and manually release/sweep the locked ~49,922.69 USDC from the Relay Adapt contract back to the owner's original public EOA (Wallet B).
SDK Edge-Case Patch: Fix the "Unshield to origin" target resolving logic so that fallback routes cannot default to the Relay Broadcaster address.
PPOI Vault Protection: Implement a whitelist/isolation mechanism for native DeFi yield vaults to prevent clean user funds from being deadlocked due to external pool mixing.
Description
Summary
When attempting to exit an integrated DeFi Yield Vault (Beefy/Morpho) that had accumulated contaminated funds, the PPOI (Private Proofs of Innocence) defense mechanism triggered a block. Executing the UI's recommended "Safely unshield to origin" feature caused the protocol to identify RAILGUN's own Relay/Broadcaster Contract (0xFA7093CDD...) as the "origin address." Consequently, 50,551 USDC was unshielded directly back into the Relay Adapt contract, leaving the funds locked on-chain with a Missing ❌ PPOI status and zero UI trace in the wallet.
Environment
App Version: Railway Windows Desktop Wallet (Latest)
Chain: Ethereum Mainnet
Integrated Protocol: Beefy / Morpho Yield Vaults (USDC Clearstar 3Jane V2, USDC Steakhouse Reservoir V2)
Affected Contract: RAILGUN: Relay / Relay Adapt (0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9)
Sequence of Events & Cross-Wallet Proof
Initial Clean Deposit:
Initial shield on Aug-15-2026 10:48:47 AM UTC possessed a 100% valid PPOI status (Valid ✅).
DeFi Vault Contamination:
Deposited funds into Railway’s natively integrated Beefy/Morpho yield vaults.
Due to external 3rd-party liquidity entering these public yield vaults, the resulting yield shares became contaminated upstream.
Cross-Wallet Deadlock (Proving Platform-Wide Issue):
Wallet A (Test): Deposited ~50 USDC into Clearstar 3Jane Vault. Redeem triggered a PPOI block.
Wallet B (Main): Deposited 50,551 USDC into Steakhouse Reservoir Vault. Redeem triggered an identical PPOI block on an entirely separate seed phrase.
Emergency Routing Logic Failure:
Navigated to Activity -> View pending balance -> Restricted and clicked "Safely unshield to origin".
The SDK erroneously set the destination origin as the Railgun Relay Contract itself (0xFA70...4b9).
The transaction succeeded on-chain, but the funds were transferred into RAILGUN's Relay Contract rather than the user's public EOA.
Root Cause Analysis
PPOI Mechanism Overreaction: Valid user deposits were tainted after interaction with native DeFi pools due to aggregated vault liquidity.
Fallback Route Invalidation: The "Unshield to origin" feature incorrectly parsed the Relay/Broadcaster contract as the original fund source (or fallback target) instead of the user's actual underlying EOA/0zk balance.
State Loss: The fallback unshield transaction lacks a standard zero-knowledge proof generation step, resulting in a Missing ❌ status in the PPOI Lookup Tool and leaving the wallet UI unable to recognize or recover the balance.
On-Chain Evidence & Transaction Log
Wallet A ($50 Test Wallet)
Shield Tx: 0x8e0a0d92be13bb62e11aa7c149b4ac9498143b29c83b1a8f6e4060f96c613446
Status: Shield Valid ✅ | Unshield Valid ✅
Redeem Tx: 0x88595cb2b05aa066512292e3484838bd322d83e17aef05da55e95a9ff765a185
Status: Shield Blocked 🚫 | Unshield Valid ✅
Wallet B ($50,000+ Main Wallet)
Shield Tx: 0xefd5ae64954fd55cc11fe71d7ee9e543175ea205644791ed4d44e4fd4c3d0e7c
Status: Shield Valid ✅ | Unshield Valid ✅
Redeem Tx: 0x319af79f60b841d04819dd588eb6ade93675454de7f23bdf6d665b05af1b4e35
Status: Shield Blocked 🚫 | Unshield Valid ✅
Fallback Unshield to Origin Tx: 0x7f7b9b625adbdc076e314981acc58ddcdfffb7f77a84e4ca821210adcf9387ac
Status: Unshield Missing ❌ (Funds currently held in Relay Adapt Contract)
Requested Action
Manual Contract Release: Inspect transaction 0x7f7b...87ac and manually release/sweep the locked ~49,922.69 USDC from the Relay Adapt contract back to the owner's original public EOA (Wallet B).
SDK Edge-Case Patch: Fix the "Unshield to origin" target resolving logic so that fallback routes cannot default to the Relay Broadcaster address.
PPOI Vault Protection: Implement a whitelist/isolation mechanism for native DeFi yield vaults to prevent clean user funds from being deadlocked due to external pool mixing.