What happened
On July 8, 2023, CivTrade v2 was exploited through its Uniswap V3 callback handling. Civilization reported that 96.7 ETH was sent to Tornado Cash; Revoke.cash estimated the loss at about $180,000. The affected balances were tokens in user wallets that had granted unlimited approvals, while traded and deposited CivTrade funds were not affected.
The team paused the product and advised users to revoke approvals.
How it happened
- The attacker created a replica Uniswap-style pool and used it to call CivTrade's callback path.
- CivTrade's check did not reliably distinguish that replica from an authorized Uniswap pool.
- The callback invoked transfers from wallets that had granted unlimited token approvals, allowing approved balances to be drained.
- Civilization paused CivTrade and directed users to revoke approvals; its analysis says the proceeds were consolidated to 96.7 ETH and sent to Tornado Cash.
Protocol details
Evidence
- report @DeDotFiSecurity incident report twitter.com
- report CivTrade Hack: Analysis medium.com
- analysis DeFiLlama defillama.com
- analysis CivTrade — 8 July 2023 revoke.cash
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
