Leaderboard
1248All-time rank
RF
Revert Finance
Feb 20, 2023
$29K
Lost
$29K
Recovered
$0
Net loss
$29K
Unrecovered0% recovered
Revert Finance's V3Utils contract was exploited through an access control vulnerability allowing arbitrary code execution. Attackers transferred approved user funds by executing unauthorized contract calls, stealing approximately $29K before the team deployed a refund bot to recover all victim funds.
How the exploit worked
View reproducible PoCArbitrary External Call Vulnerability.
Lost: ~$30k
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Arbitrary External Call
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Feb 20, 2023Exploit executed — $29K drained via arbitrary external call
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)