Badger DAO Hack
What happened
BadgerDAO users lost about $120.3 million on December 2, 2021 after the delivery path for the protocol's web application was compromised. This was not a flaw in Badger's vault contracts. Malicious code served through Cloudflare Workers asked selected users to approve the attacker as an ERC-20 spender, allowing later allowance-based transfers from their wallets.
Control of trusted front-end delivery infrastructure allowed an attacker to alter sensitive wallet-transaction requests. The security failure was API-key and frontend-integrity control, combined with inadequate detection of suspicious spender approvals, rather than a vault authorization bug. Protocols must audit the transaction-building path and CDN deployment controls alongside contracts, including key scope, rotation, integrity monitoring, and alerts for one EOA receiving approvals across many tokens.
How it happened
An unauthorized Cloudflare Workers API key was used to inject malicious script into Badger's front end. The injection was selective, targeting only part of the user base. When an affected user interacted with the dApp, the injected code added or substituted an ERC-20 approval naming the attacker-controlled address as spender.
The wallet signatures were valid approvals, so the attacker could use standard transferFrom paths to drain assets without exploiting a Badger vault contract. Badger paused contracts where possible, causing some later drain attempts to fail.
Protocol details
Security review history
- HAECHI Audit View report
- Code4rena View report
- Quantstamp View report
- Zokyo View report
Funds Recovery
Recovered
$9.1M
Net Loss
$111,865,559
Evidence
- report Report badger.com
- report PeckShield 2021 security report peckshield.com
- transaction Etherscan representative draining transaction etherscan.io
- analysis Website reference archive.is
- analysis DeFiLlama defillama.com
- analysis BadgerDAO recovery phase oldlandingpage.badger.com
- analysis BadgerDAO turning the lights back on oldlandingpage.badger.com
- analysis Microsoft analysis of the BadgerDAO attack microsoft.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
