What happened
On 7 November 2024, several MEV bots drained about $59K of protocol fees from CoW Protocol's settlement contract (GPv2Settlement) on Ethereum. The settlement contract had given token approvals to an unverified helper contract (0xa58c...0109), and that helper exposed an unrestricted uniswapV3SwapCallback function. Anyone could call the callback with made-up swap amounts and make it pull approved tokens out of the settlement contract.
A CoW DAO forum post published on 8 November 2024 describes what appears to be the same incident from the solver side. It says GlueX was exploited through one of the contracts it had onboarded to cut execution costs on one type of DEX, dates the exploit to 8 November, and does not name the helper address; the attack transaction itself was mined on 7 November at 11:20 UTC. According to the post, the flaw let any address move collected fees out of the settlement contract and stayed open for about an hour. The funds lost were fee buffers held in the settlement contract, and the post gives no sign that user orders were affected. It proposed limiting the total funds kept in the settlement contract to $5,000 worth of tokens, with anything above that moved to a separate fee collection contract, to limit future losses.
How it happened
GPv2Settlementheld accumulated fee balances and had granted token approvals, including for WETH, to the solver's helper contract0xa58c...0109.- The helper's
uniswapV3SwapCallbackdid not check that the caller was a genuine Uniswap V3 pool. - An attacker contract called that callback directly, passing fake swap deltas and encoded data that named the settlement contract as the payer and the attacker as the recipient. Acting on that data, the helper transferred WETH from the settlement contract to the attacker.
- The attacker unwrapped the WETH to ETH and sent it to its EOA. Several MEV bots repeated the pattern until the hole was closed, with total losses TenArmor estimated at about $59K.
Protocol details
Evidence
- report TenArmor Security Alert on CoW Protocol GPv2Settlement (X, via fxtwitter mirror) x.com
- transaction Etherscan: attack transaction 0x2fc9f2fd...edc4f9 etherscan.io
- analysis DeFiLlama defillama.com
- analysis DeFiHackLabs CoW_exp.sol PoC raw.githubusercontent.com
- analysis Settlement Contract Buffers (CoW DAO forum, Technical) forum.cow.fi
- analysis www.cow.cm page www.cow.cm cow.cm
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
