BasketDAO Hack

On 30 March 2022 an attacker drained tokens from users who had approved BasketDAO's BMIZapper contract on Ethereum. BMIZapper was a helper for minting BasketDAO's BMI index token. It could make external calls built from caller-supplied input, so the attacker used it to call transferFrom on tokens that users had approved to the zapper and send the funds to themselves. Reported losses are about $1.1 million (Fairyproof) to $1.2 million (Revoke.cash).

BasketDAO told users on 30 March to revoke all approvals for BMIZapper (0x4622aFF8E521A444C9301dA0efD05f6b482221b8). A day later it reported a similar vulnerability in BMIBurner (0x01A903c12A2Dd87A5410173A29543504DF8bD14B). The project had already been winding down after an October 2021 exploit of a different helper contract. Because the contracts stayed on-chain, wallets that never revoked their approvals could still be drained years later.