On April 19, 2024, HedgeyFinance suffered an exploit resulting in an estimated loss of $45 million. A design error in the Campaign contract permitted an attacker to directly steal a substantial amount of assets. In this blog, we will analyze the first attack on the Ethereum network to help users prevent similar vulnerabilities in their own projects.

<p>On April 19, 2024, HedgeyFinance suffered an exploit resulting in an estimated loss of $45 million. A design error in the Campaign contract permitted an attacker to directly steal a substantial amount of assets.</p><p>In this blog, we will analyze the first attack on the Ethereum network to help users prevent similar vulnerabilities in their own projects.</p><div><div><div><p>Thanks for reading Verichains! Subscribe for free to receive new posts and support my work.</p></div><div><div></div><div></div></div></div></div><h2>Overview</h2><p>Attacker:</p><p><a href="https://etherscan.io/address/0xded2b1a426e1b7d415a40bcad44e98f47181dda2" rel="nofollow">https://etherscan.io/address/0xded2b1a426e1b7d415a40bcad44e98f47181dda2</a></p><p>Vulnerable Contract:</p><p><a href="https://etherscan.io/address/0xbc452fdc8f851d7c5b72e1fe74dfb63bb793d511" rel="nofollow">https://etherscan.io/address/0xbc452fdc8f851d7c5b72e1fe74dfb63bb793d511</a></p><p>Transaction attack:</p><p><a href="https://etherscan.io/tx/0xa17fdb804728f226fcd10e78eae5247abd984e0f03301312315b89cae25aa517" rel="nofollow">https://etherscan.io/tx/0xa17fdb804728f226fcd10e78eae5247abd984e0f03301312315b89cae25aa517</a></p><p><a href="https://etherscan.io/tx/0x2606d459a50ca4920722a111745c2eeced1d8a01ff25ee762e22d5d4b1595739" rel="nofollow">https://etherscan.io/tx/0x2606d459a50ca4920722a111745c2eeced1d8a01ff25ee762e22d5d4b1595739</a></p><h2>Exploit Analysis</h2><p>Following the first transaction, the attack methodology was surprisingly straightforward. The attacker borrowed a large amount of USDC to create a locked campaign and then immediately canceled it.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fa957e94c-6cf2-4dee-8589-ef60fb833a70_2496x914.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/a61c9e226be8b37f1e8e5bf2dd064056.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>In the second transaction, the attacker triggered the contract to transfer USDC directly from the HedgeyFinance contract to their own address.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F90bd4a27-82f2-4c36-84f3-3299c517b658_2482x284.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/5b334a1f9367df61b976daf66c7cfd21.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>The simplicity of the second transaction strongly suggests that the root cause of the exploit lies in the <code>createLockedCampaign</code> and <code>cancel</code> functions from step 1.</p><p>Investigate the createLockedCampaign function</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F572423da-93c1-4561-ba4b-babe23cbbe11_1940x1220.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/80986f5e04f7ad9ca0f32be5a4cd8981.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>During the creation of a locked campaign, the owner has the ability to designate a tokenLocker. This tokenLocker, upon receiving approval, can then transfer out all the tokens associated with the newly created campaign. This behavior appears to be a potential vulnerability.</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F37e738ba-6e28-46e4-8518-44e28ea9b539_1978x348.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/f4a244bc78e3d917fae0df39c57e80ce.jpg" alt=""></source></picture><div></div></div></a></figure></div><p>While the function comment indicates an intent to prevent anyone from claiming additional tokens, it appears to only restrict access to reward tokens. Crucially, the function doesn't revoke approval granted in a previous step. This oversight allows the attacker to withdraw all staked tokens within the campaign while retaining the approval from the earlier step.</p><p>With this lingering approval, the attacker can easily transfer tokens out of the contract to any desired location.</p><p>By analyzing the <code>createLockedCampaign</code> function in reverse, it becomes clear that the approval logic is flawed. Granting the ability for a locked campaign to transfer tokens out at any time contradicts the expected behavior. This design flaw is the root cause of the HedgeyFinance exploit.</p><h2>Lesson learned</h2><p>The HedgeyFinance exploit highlights the severe consequences of failing to manage token approvals carefully within smart contracts. Here are key takeaways:</p><ul><li><p><strong>Approval is Power:</strong> In DeFi systems, granting approval to a contract often means giving it the power to transfer your tokens. Treat approvals with the same caution as sending funds directly.</p></li><li><p><strong>Revoke When Done:</strong> When an interaction with a smart contract is complete, diligently revoke any approvals that are no longer required. This limits the potential attack surface.</p></li></ul><div><div><div><p>Thanks for reading Verichains! Subscribe for free to receive new posts and support my work.</p></div><div><div></div><div></div></div></div></div>

Approval Error Vulnerability: Analyzing the HedgeyFinance Attack

2024 年 4 月 19 日，HedgeyFinance 遭受攻击，估计损失 4500 万美元。Campaign 合约中的设计错误允许攻击者直接窃取大量资产。在本博客中，我们将分析对以太坊网络的第一次攻击，以帮助用户防止自己的项目中出现类似的漏洞。

<p>2024 年 4 月 19 日，HedgeyFinance 遭受攻击，造成估计损失 4,500 万美元。 Campaign 合约中的设计错误允许攻击者直接窃取大量资产。</p><p>在本部落格中，我们将分析以太坊网路上的第一次攻击，以帮助使用者预防自己专案中的类似漏洞。</p><div><div><div><p>感谢您阅读 Verichains！免费订阅以接收新帖子并支持我的工作。</p></div><div><div></div><div></div></div></div></div><h2>概述</h2><p>攻击者：</p><p> <a href="https://etherscan.io/address/0xded2b1a426e1b7d415a40bcad44e98f47181dda2" rel="nofollow">https://etherscan.io/address/0xded2b1a426e1b7d415a40bcad44e98f47181dda2</a></p><p>脆弱合约：</p><p> <a href="https://etherscan.io/address/0xbc452fdc8f851d7c5b72e1fe74dfb63bb793d511" rel="nofollow">https://etherscan.io/address/0xbc452fdc8f851d7c5b72e1fe74dfb63bb793d511</a></p><p>交易攻击：</p><p> <a href="https://etherscan.io/tx/0xa17fdb804728f226fcd10e78eae5247abd984e0f03301312315b89cae25aa517" rel="nofollow">https://etherscan.io/tx/0xa17fdb804728f226fcd10e78eae5247abd984e0f03301312315b89cae25aa517</a></p><p> <a href="https://etherscan.io/tx/0x2606d459a50ca4920722a111745c2eeced1d8a01ff25ee762e22d5d4b1595739" rel="nofollow">https://etherscan.io/tx/0x2606d459a50ca4920722a111745c2eeced1d8a01ff25ee762e22d5d4b1595739</a></p><h2>漏洞利用分析</h2><p>在第一笔交易之后，攻击方法出乎意料地简单。攻击者藉用大量USDC来建立锁定活动，然后立即取消活动。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fa957e94c-6cf2-4dee-8589-ef60fb833a70_2496x914.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/a61c9e226be8b37f1e8e5bf2dd064056.jpg" alt=""></source></picture><div></div></div></figure></div><p>在第二笔交易中，攻击者触发合约将USDC直接从 HedgeyFinance 合约转移到自己的地址。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F90bd4a27-82f2-4c36-84f3-3299c517b658_2482x284.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/5b334a1f9367df61b976daf66c7cfd21.jpg" alt=""></source></picture><div></div></div></figure></div><p>第二笔交易的简单性强烈表明，该漏洞利用的根本原因在于步骤 1 中的<code>createLockedCampaign</code>和<code>cancel</code>函数。</p><p>研究 createLockedCampaign 函数</p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F572423da-93c1-4561-ba4b-babe23cbbe11_1940x1220.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/80986f5e04f7ad9ca0f32be5a4cd8981.jpg" alt=""></source></picture><div></div></div></figure></div><p>在建立锁定活动期间，拥有者可以指定 tokenLocker。该 tokenLocker 在获得批准后，可以转出与新创建的活动相关的所有代币。此行为似乎是一个潜在的漏洞。 </p><div><figure><a href="https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F37e738ba-6e28-46e4-8518-44e28ea9b539_1978x348.png" rel="nofollow"><div><picture><source><img src="https://static.fwimg.io/img/feed/f4a244bc78e3d917fae0df39c57e80ce.jpg" alt=""></source></picture><div></div></div></figure></div><p>虽然函数注释表明意图阻止任何人要求额外代币，但它似乎仅限制对奖励代币的存取。至关重要的是，该功能不会撤销上一步中授予的批准。这种疏忽允许攻击者撤回活动中所有质押的代币，同时保留先前步骤的批准。</p><p>透过这种持续的批准，攻击者可以轻松地将代币从合约转移到任何所需的位置。</p><p>透过逆向分析<code>createLockedCampaign</code>函数，可以明显看出审批逻辑有缺陷。授予锁定活动随时转出代币的能力与预期行为相矛盾。这项设计缺陷是 HedgeyFinance 漏洞的根本原因。</p><h2>学过的知识</h2><p>Hedgefinance 漏洞凸显了未能在智能合约中仔细管理代币批准的严重后果。以下是重点：</p><ul><li><p><strong>批准就是权力：</strong>在 DeFi 系统中，批准合约通常意味著赋予其转移代币的权力。像直接发送资金一样谨慎对待批准。</p></li><li><p><strong>完成后撤销：</strong>与智能合约的互动完成后，认真撤销不再需要的任何批准。这限制了潜在的攻击面。</p></li></ul><div><div><div><p>感谢您阅读 Verichains！免费订阅以接收新帖子并支持我的工作。</p></div><div><div></div><div></div></div></div></div>

批准错误漏洞：分析 HedgeyFinance 攻击

比特币上周价格一度触及 6 万美元。在收益递减模型下，这绝不是简单的噪音。市场正在触碰整个四年周期与对数增长框架中最脆弱的环节。
当比特币周期顶部的涨幅已被大幅压缩，如果再出现历史级别的深度回调，其经典周期的吸引力将彻底失效。
这不是预测，这是数学规律。
周期顶部涨幅正在压缩
比特币各周期历史顶部：
· 2013 年：~1,242 美元
· 2017 年：~19,700 美元
· 2021 年：~...

5.5万美元，将是比特币的生死线

Citadel、Ark Invest 和 Tether 支持 LayerZero上线Zero区块链——ZRO 价格剧烈波动。图片来源：Decrypt。
今天清晨（2月11日），LayerZero官方宣布上线其名为…的全新Layer-1区块链。

Citadel、Ark Invest 和 Tether 支持 LayerZero上线Zero区块链——价格 Z...

加密市场今日下午出现急跌走势，以太坊于台湾时间下午三点跌破 2,000 美元关口，在 Hyperliquid […]
〈麻吉大哥亏惨一夜没睡？以太坊跌破2000镁慌了， 开仓做多ETH、HYPE 割肉12万镁全输光〉这篇文章最早发布于动区BlockTempo《动区动趋-最具影响力的区块链新闻媒体》。