Leaderboard
1302All-time rank
E
Erc20transfer
Oct 22, 2024
$15K
Lost
$15K
Recovered
$0
Net loss
$15K
Unrecovered0% recovered
An unverified Ethereum contract intended as an ERC20 transfer utility lacked access control in its erc20TransferFrom function, allowing anyone to transfer tokens from users who had granted approval, draining USDC across multiple victims.
How the exploit worked
View reproducible PoCAccess Control.
Lost: $14,773.35
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Improper Access Control
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Oct 22, 2024Exploit executed — $15K drained via improper access control
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)