Brahma Finance Hack

Reported loss $90K
Ethereum
Other

What happened

On November 9, 2022, an attacker stole 89,343.76 USDC from three users of Brahma's TopGear vault (brahTOPG) on Ethereum. The users had approved the vault's Zapper contract to spend their USDC. The Zapper's zapIn function took a caller-supplied token, swap target and call data and did not validate them, so the attacker could make it perform an arbitrary external call that pulled USDC from wallets that had approved it. The vault itself was not drained; only the three approving wallets lost funds.

About four minutes later the attacker swapped the 89,343.76 USDC for about 89,335 DAI on Uniswap V3. SlowMist put the loss at $89,879.

**Block data**

  • Attacker: 0x6fa00a7324dc293ea8ecf56fe3143104494c4213
  • Attack contract: 0x60032a41726241499b0c626c836c9099cb895c05
  • Exploit tx: 0xeaef2831d4d6bca04e4e9035613be637ae3b0034977673c1c2f10903926f29c0
  • Swap to DAI: 0x4249331dd223230b701331a4ee36ec4bb37032435da51ec53368bc1d224181a0

How it happened

  1. The attacker's EOA called its attack contract, which checked a victim's USDC balance.
  2. The contract called the Zapper's zapIn, passing a fake token as requiredToken and attacker-built callData for the external call to swapTarget.
  3. Because the Zapper did not validate these values, it made the attacker-specified call, which moved the victim's approved USDC to the attack contract.
  4. The contract repeated this for three wallets (about 79,680, 5,365 and 4,299 USDC) and forwarded the 89,343.76 USDC to the attacker's EOA in the same transaction.
  5. The attacker then swapped the USDC for DAI on Uniswap V3.

Protocol details

Classification Exchange (DEX) / Yield Aggregator / Access Control
Protocol Type Exploit/Other
Affected asset / contract brahTOPG
Implementation language Solidity
Protocol links Website @brahmafi

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks Delegatecall & Call Injection Attacks

Same attack technique

Browse all hacks →
Ethereum Aave $56K lost BNB Chain Chainge Finance $716K lost Ethereum BasketDAO $1.2M lost Ethereum CoW Swap $180K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes