What happened
On August 1, 2024, Convergence Finance, a yield booster built on Curve and Convex, lost about $210,000 when an attacker minted 58 million CVG tokens from its CvxRewardDistributor contract and sold them. About $2,000 of unclaimed Convex rewards held by the contract was also taken, bringing the total to roughly $212,000.
The bug sat in claimMultipleStaking(), which accepts a claimContracts array and asks each listed staking contract how much CVG its caller can claim. The function did not check that the listed addresses were real Convergence staking contracts. According to the team's post-mortem, the check had existed but was removed in a post-audit gas-optimization change.
The attacker passed a malicious contract that implemented a function with the same signature as claimCvgCvxMultiple and reported an inflated claimable amount, so the distributor minted CVG meant for staking emissions straight to the attacker. The CVG was dumped into CVG liquidity pools, and reports say the proceeds were swapped to about 60 WETH and 15,900 crvFRAX. CVG fell about 99% to around $0.0004. SolidityScan reports the stolen funds were later moved through Tornado Cash routers.
Convergence said user funds in the protocol were safe, told users to withdraw their assets, and said it would fix the Stake DAO rewards contract before users could reclaim rewards.
**Block data**
- Exploiter:
0x03560a9d7a2c391fb1a087c33650037ae30de3aa - Victim (
CvxRewardDistributorproxy):0x2b083beaac310cc5e190b1d2507038ccb03e7606 - Exploit tx:
0x636be30e58acce0629b2bf975b5c3133840cd7d41ffc3b903720c528f01c65d9
How it happened
- The attacker deployed a contract that exposes a function with the same signature as
claimCvgCvxMultiple, the callCvxRewardDistributormakes to each staking contract to learn what a user can claim. - They called
claimMultipleStaking()and put their contract's address in theclaimContractsarray. - With no validation of
claimContracts, the distributor called the fake contract as if it were a legitimate staking contract, and the fake contract returned an inflated claimable CVG amount. - The distributor minted about 58 million CVG to the attacker, and the same call also collected roughly $2,000 of unclaimed Convex rewards.
- The attacker sold the CVG into the CVG liquidity pools for WETH and crvFRAX, collapsing the token price by about 99%.
Protocol details
Security review history
- CertiK View report
Evidence
Proof of concept
1 availableSources
- report Twitter/X Alert x.com
- report Report coindesk.com
- transaction etherscan.io transaction 0x636b…65d9 etherscan.io
- address etherscan.io address 0x0356…e3aa etherscan.io
- address etherscan.io address 0x2b08…7606 etherscan.io
- analysis DeFiLlama defillama.com
- analysis Convergence incident - How a simple vulnerability caused a $210K loss blog.verichains.io
- analysis DeFi protocol Convergence removed an important line of code that led to a $212K hack cointelegraph.com
- analysis Convergence Finance Hack Analysis blockapex.io
- analysis Convergence Finance Hack Analysis blog.solidityscan.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
