Leaderboard
698All-time rank
Auctus
Mar 26, 2022
$726K
Lost
$726K
Recovered
$0
Net loss
$726K
Unrecovered0% recovered
Auctus options protocol had a beta contract allowing arbitrary low-level calls with controlled calldata. An attacker exploited this to drain approved user funds from wallets, targeting those who had granted unlimited approval to the contract.
How the exploit worked
View reproducible PoCArbitrary Call.
Lost: $726 k
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Arbitrary External Call
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Mar 26, 2022Exploit executed — $726K drained via arbitrary external call
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)