Incident Overview
Convergence Finance Exploited on August 1st, 2024: $210K in CVG Tokens Stolen
On August 1st, 2024, Convergence Finance, a yield-enhancing protocol based on Curve, was compromised due to inadequate input validation, resulting in the loss of 58 million CVG tokens, equivalent to approximately $210,000. The vulnerability was traced to the claimMultipleStaking function in the CvxRewardDistributor.sol contract, specifically the cvxRewardCount parameter. This function failed to validate the staking contracts listed in the claimContracts array, allowing the attacker to manipulate the reward distribution process.
The attacker deployed a malicious contract with a function signature matching claimCvgCvxMultiple, used to process reward claims. By including their malicious contract in the claimContracts array, the attacker tricked the claimMultipleStaking function into calling it as if it were a legitimate staking contract. This exploit enabled the attacker to mint 58 million CVG tokens intended for staking emissions.
The stolen tokens have since been moved through Tornado Cash Routers.
Exploiter:
https://etherscan.io/address/0x03560a9d…0de3aa
Victim:
https://etherscan.io/address/0x2b083bea…3E7606
Exploit tx:
https://etherscan.io/tx/0x636be30e…1c65d9
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Convergence, these are the critical security checks that could have prevented this incident (August 2024).
- Verify all logic paths related to Missing Input Validation / Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Audit Report 1 Report
Proof-of-Concept Exploits
On-Chain Evidence & References
- Twitter/X Alert https://x.com/DecurityHQ/status/1819030089012527510
Sources & References
Learn to Prevent the Next Convergence
The Convergence hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.