What happened
Chainge Finance's MinterProxyV2 contract allowed attackers to drain tokens using allowances previously granted to it. HashDit linked the affected wallet to the project team, while the technical analysis identified attacker-controlled swap targets and calldata.
Technical root cause
The swap function accepted arbitrary external-call targets and calldata. A caller could invoke token transferFrom through MinterProxyV2 and exploit allowances granted by another wallet.
How it happened
- The victim wallet approved tokens for MinterProxyV2 to spend.
- The attacker supplied a token address and a crafted transferFrom call as swap parameters.
- MinterProxyV2 executed that call with its own spending authority, moving approved tokens from the victim.
- Repeating the call against different tokens drained additional balances.
Protocol details
Classification
Other / Access Control
Protocol Type
DEX
Implementation language
Solidity
Protocol links
Website
@FinanceChainge
Security review history
- CertiK View report
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
