What happened
Bent Finance disclosed an insider-enabled Ethereum exploit affecting its cvxCRV and MIM pools. Before the ownership migration to multisig, a rogue developer used deployer upgrade authority to insert malicious pool logic, credit an attacker-controlled address with balances far beyond pool TVL, and then conceal the code change with a clean implementation.
Privileged upgrade authority was not protected by a multisig. A malicious implementation could directly modify accounting state, creating an artificial user balance that withdrawal logic treated as legitimate.
Case & protocol details
Attack Timeline
The upgradeable pools remained controlled by a single deployer key during the multisig migration. On November 30, 2021, malicious upgrades enabled hardcoded balances for the attacker address. Replacing the malicious implementation did not undo the stored balance, and the attacker later withdrew 513,000 cvxCRV LP tokens.
Security review history
- Hacken Report
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Post-mortem rekt.news
- transaction Transaction etherscan.io
- analysis Website reference twitter.com
- analysis Bent Finance incident update bentfi.medium.com
- analysis Halborn Bent Finance analysis halborn.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.