Cover Protocol Hack

Reported loss $9.4M
Ethereum
Near-empty pool reward amplification

What happened

Cover Protocol's Blacksmith reward-mining contract was exploited on December 28, 2020 at 08:08 UTC. The core coverage product was not affected. The flaw let attackers mint unearned COVER rewards through stale reward-accounting state, causing about $9.4 million in damage.

Grap Finance returned 4,351 ETH, which Cover reported as about 34% of the total damage.

Technical root cause

Reward debt was calculated from a stale in-memory pool snapshot after the authoritative storage state had been updated. Near-empty pools made the resulting accounting mismatch arbitrarily large. Staking-reward systems must preserve accounting invariants across deposit, withdrawal, and claim sequences, especially with one-wei residual balances, and must not compute user writeoffs from stale pool state.

How it happened

  1. Blacksmith's deposit() copied a Pool struct to memory before updatePool() updated the storage-side accRewardsPerToken.
  2. It then calculated the depositor's rewardWriteoff from the stale memory copy.
  3. Attackers amplified the gap by reducing a pool's LP balance to nearly zero, redepositing, and triggering the reward calculation.
  4. The updated accumulator rose sharply because the denominator was tiny while the account writeoff remained too small.
  5. Grap Finance left one wei in its pool before redepositing, minted an enormous amount of COVER through the discrepancy, sold part of it, burned the remainder, and returned 4,351 ETH.
  6. Cover removed Blacksmith's minting rights to stop the exploit.

Protocol details

Classification Reward Accounting / Stale State
Protocol Type Insurance
Affected asset / contract COVER
Implementation language Solidity
Protocol links Website @COVERProtocol
Attacker Address 0x85abf036ca922e56fed670f4d3ce53fc4ea52b95
Exploit Transaction 0xadf27f5dd052482d46…8f6ea4373b

Security review history

Funds Recovery

34%

Recovered

$3.2M

Net Loss

$6,204,000

Evidence

Proof of concept

1 available

Sources

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes