What happened
Bent Finance disclosed an insider-enabled Ethereum exploit affecting its cvxCRV and MIM pools. Before the ownership migration to multisig, a rogue developer used deployer upgrade authority to insert malicious pool logic, credit an attacker-controlled address with balances far beyond pool TVL, and then conceal the code change with a clean implementation.
Privileged upgrade authority was not protected by a multisig. A malicious implementation could directly modify accounting state, creating an artificial user balance that withdrawal logic treated as legitimate.
How it happened
The upgradeable pools remained controlled by a single deployer key during the multisig migration. On November 30, 2021, malicious upgrades enabled hardcoded balances for the attacker address. Replacing the malicious implementation did not undo the stored balance, and the attacker later withdrew 513,000 cvxCRV LP tokens.
Protocol details
Security review history
- Hacken View report
Evidence
- report Post-mortem rekt.news
- report @BlockSecTeam incident report twitter.com
- transaction Etherscan withdrawal transaction etherscan.io
- analysis DeFiLlama defillama.com
- analysis Bent Finance incident update bentfi.medium.com
- analysis Halborn Bent Finance analysis halborn.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
