28 May 2025, 11:39 UTC
Cork Protocol: Rollover Pricing and Hook Auth Bypass Drained 3,761 wstETH
Cork: on 28 May 2025 an attacker extracted 3,761 wstETH from the wstETH:weETH Liquidity Vault by combining rollover-price skew with a Cork Hook authorization bypass. All markets paused.
- Event date
- Incident typeSmart-contract exploit
- Bug classAccess control
- Published
Loss, as sourced
3,761 wstETH extracted from the wstETH:weETH Liquidity Vault, per Cork. Cork says ~$20M remained locked in other unimpacted Liquidity Vaults.
Traceability
Primary sources
In brief
Root cause: Per Cork: (1) near-expiry DS trade skewed HIYA rollover pricing so Cover Tokens could be bought for near-zero RA after rollover; (2) attacker Uniswap V4 hook spoofed Cork Hook beforeSwap data to bypass FlashSwapRouter checks and extract Depeg Swaps. Combined CT+DS redeemed for wstETH.
Timeline, as sourced: Per Cork (UTC, 28 May): 11:39 exploit; 11:43 Hypernative alert; 12:33–12:35 pause txs executed; 13:21 official X statement; POC by 29 May.
Account, as sourced
Claimed (Cork) (post-mortem (opens in a new tab)): Beta launched 4 Mar 2025; Liquidity Vaults had grown to $32M across 5 markets before the exploit.
Claimed (Cork): Cork Hook used a Uniswap V4 periphery version that lacked a later upstream authorization check added 6 Feb 2025.
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/cork-wsteth-weeth-vault-2025