Leaderboard
984All-time rank
CivFund
Jul 9, 2023
$180K
Lost
$180K
Recovered
$0
Net loss
$180K
Unrecovered0% recovered
CivFund had unrestricted token approvals that allowed an attacker to drain users' approved funds. The exploit abused callback functions to execute unauthorized fund transfers to Uniswap for liquidation.
How the exploit worked
View reproducible PoCLack of access control.
Lost: ~$165k
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Token Approval Abuse
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Jul 9, 2023Exploit executed — $180K drained via token approval abuse
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)