How much was lost in the Cover Protocol hack?

The Cover Protocol hack resulted in $9.4M in losses on December 29, 2020.

What attack technique was used in the Cover Protocol exploit?

The Cover Protocol exploit utilized Incentives Function Mistake / Other. Understanding this attack vector is critical for smart contract auditors and developers building secure DeFi protocols.

How can developers prevent similar smart contract attacks?

Preventing smart contract hacks requires a combination of secure coding practices, thorough security audits, and understanding common attack vectors like reentrancy, oracle manipulation, and access control flaws. Smart Contract Hacking (SCH) provides hands-on training to help developers and auditors identify and prevent vulnerabilities before deployment.

Cover Protocol Hack

TOTAL LOST $9.4M

Medium Dec 29, 2020 Incentives Function Mistake / Other ethereum

Affected Chain ethereum Incident surface

Recovered $3.2M 34.0% returned

All-Time Rank #318 By amount stolen

Auditors 1 Prior security audit

Incident Overview

Quick Summary

Exploit in Blacksmith contract leads to theft of $4.4 million in $COVER tokens.

Details of the Exploit

The attacker exploited the Blacksmith contract by depositing BPT tokens, and then withdrawing them along with a large amount of $COVER tokens. The attacker continued to mint and sell $COVER tokens while the vulnerability was still present. In total, the attacker stole around $4.4 million of user funds.

Grap Finance Deployer also exploited the same vulnerability, minting a large amount of $COVER tokens and selling them on 1inch.exchange. They then burned the minted tokens and transferred the ETH they had gained to the deployer account.

Block Data Reference

Exploiter 1's address:

https://etherscan.io/address/0x85abf036…a52b95#tokentxns

Transactions involved in the exploit:

https://etherscan.io/tx/0xd721b0ef…8f7a50

https://etherscan.io/tx/0xadf27f5d…a4373b

https://etherscan.io/tx/0x66128a16…754beb

https://etherscan.io/tx/0xf81fb72e…fa79da

https://etherscan.io/tx/0xca135d1c…5b035f

https://etherscan.io/tx/0xaf94d9b5…866a6b

https://etherscan.io/tx/0x01b35178…caa959

https://etherscan.io/tx/0xe6c068ca…8cb5d2

https://etherscan.io/tx/0x23cb9bdf…4a3051

https://etherscan.io/tx/0xc2fd5094…3f982e

Incident Report

Protocol / Project Cover Protocol

Date of Incident December 29, 2020

Affected Chain(s) ethereum

Attack Technique Incentives Function Mistake / Other

Classification Protocol Logic / Other

Primary Source View Post-Mortem

Protocol Information

Protocol Type Insurance

Affected Token COVER

Smart Contract Language Solidity

Official Website www.coverprotocol.com/

Protocol Twitter/X @COVERProtocol

Team Anonymous

Source Code Unverified

Market Context at Time of Hack

Token Categories

Wallet Layer 1

Protocol Links

GitHub Discord

What the Attacker Needed to Succeed

Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.

Technical Knowledge Deep understanding of incentives function mistake / other and Solidity and EVM internals

Capital Required Seed capital to cover gas and initial position setup

On-Chain Access Ability to interact with ethereum smart contracts and deploy a custom exploit contract

Protocol Analysis Identification of the exploitable vulnerability in Cover Protocol's contract logic - root cause: protocol logic / other

Execution Speed Precise transaction ordering and timing to exploit the vulnerability within a single atomic block

Obfuscation Plan A strategy to launder and move stolen funds - typically through mixers, cross-chain bridges, or decentralized DEX swaps to resist tracing

What Auditors Should Check

Could this have been caught in audit? Likely — with a thorough Incentives Function Mistake / Other audit checklist and test coverage

Audited by Audit Report 1 — still lost $9.4M. Prior audits don't guarantee safety, especially after post-audit code changes.

If you're auditing a protocol with similar architecture to Cover Protocol, these are the critical security checks that could have prevented this incident (December 2020).

Verify all logic paths related to Incentives Function Mistake / Other are guarded by proper access controls and input validation
Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs

Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.

Free Trial

Funds Recovery

34.0%

Recovered

$3.2M

Net Loss

6204000

Security Audit History

Audit Report 1 Report

Proof-of-Concept Exploits

1 PoC available

poc-exploits - cover protocol

$ Cover Protocol Incorrect calculation via cached data

On-Chain Evidence & References

Sources & References

01
Source 1 https://coverprotocol.medium.com/12-28-post-mortem-34c5f9f718d4
02
Reference https://rekt.news/cover-rekt/
03
Reference https://www.notion.so/Cover-Infinite-Mint-Exploit-0a234cc2794849…

Threat Assessment

Severity Level

MEDIUM

Attack Vector Incentives Function Mistake / Other
Root Cause Protocol Logic / Other
Year 2020

Learn to Prevent the Next Cover Protocol

The Cover Protocol hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.

Start Free Trial Browse Attack Library