Convergence Hack

Convergence Finance Exploited on August 1st, 2024: $210K in CVG Tokens Stolen

On August 1st, 2024, Convergence Finance, a yield-enhancing protocol based on Curve, was compromised due to inadequate input validation, resulting in the loss of 58 million CVG tokens, equivalent to approximately $210,000. The vulnerability was traced to the claimMultipleStaking function in the CvxRewardDistributor.sol contract, specifically the cvxRewardCount parameter. This function failed to validate the staking contracts listed in the claimContracts array, allowing the attacker to manipulate the reward distribution process.

The attacker deployed a malicious contract with a function signature matching claimCvgCvxMultiple, used to process reward claims. By including their malicious contract in the claimContracts array, the attacker tricked the claimMultipleStaking function into calling it as if it were a legitimate staking contract. This exploit enabled the attacker to mint 58 million CVG tokens intended for staking emissions.

The stolen tokens have since been moved through Tornado Cash Routers.

Exploiter:

https://etherscan.io/address/0x03560a9d…0de3aa

Victim:

https://etherscan.io/address/0x2b083bea…3E7606

Exploit tx:

https://etherscan.io/tx/0x636be30e…1c65d9