19 Apr 2024, 07:06:47 UTC
Hedgey ClaimCampaigns: Create-and-Cancel Left Token Allowances Open
Hedgey: on 19 Apr 2024 ClaimCampaigns.sol let an attacker create a locked campaign approving a malicious locker, cancel without revoking allowance, then drain. ~$45M notional across chains.
- Event date
- Incident typeSmart-contract exploit
- Bug classAccess control
- Published
Loss, as sourced
Approximately $45mm of notional value across Ethereum, Arbitrum and other chains, per Hedgey. First Ethereum exploit removed 1.3M USDC then swapped further balances for 654 ETH; an Arbitrum copy removed ~$40mm notional from one project (that project froze CEX deposits and reissued).
Traceability
Primary sources
In brief
Root cause: Per Hedgey: createLockedCampaign approved claimLockup.tokenLocker for the full campaign amount without restricting locker to Hedgey contracts; cancelCampaign deleted state and returned tokens but did not decreaseAllowance.
Timeline, as sourced: Per Hedgey: 19 Apr 07:06:47 UTC first malicious tx; SEAL 911 war room; projects told to cancel campaigns; 23 of 60 active campaigns lost funds.
Account, as sourced
Claimed (Hedgey) (post-mortem (opens in a new tab)): limited to ClaimCampaigns; vesting/lockup contracts unaffected; Consensys Diligence had audited the contract.
First exploit tx: https://etherscan.io/tx/0x2606d459a50ca4920722a111745c2eeced1d8a01ff25ee762e22d5d4b1595739
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/hedgey-claimcampaigns-allowance-2024