Curio Hack
What happened
In March 2024, an attacker exploited CurioDAO's MakerDAO-derived voting and pause contracts on Ethereum to mint about 1 billion CGT governance tokens without authorization. The attacker used the inflated supply against liquidity across Curio's EVM ecosystem and moved assets across networks. Curio reported a $16 million ecosystem impact, although its own recovery plan separately listed roughly $180,000 of direct non-CGT liquidity-pool losses across Ethereum, BNB Chain, SKALE, and Boba.
Curio's governance access-control design allowed insufficient CGT voting power to obtain the authority required to schedule and execute a malicious library. The execution path delegatecalled the approved library with Curio's own storage and privileges, allowing arbitrary privileged actions including token minting.
How it happened
The attacker acquired a small amount of CGT and exploited the DAO's voting-power privilege logic to elevate their authority. With that authority, they used plot to approve a malicious contract as an executable library, then used the pause contract's exec path to delegatecall into it. Because delegatecall executes the library code in Curio's contract context, the malicious code exercised Curio's privileges to mint roughly 1 billion CGT. The attacker then exchanged or bridged the newly minted supply against available liquidity.
Curio's recovery plan identified the affected EVM liquidity pools and distinguished their direct non-CGT losses from the broader market impact of the unauthorized mint. The stored amount therefore remains the reported incident impact rather than a claim that the attacker realized that entire nominal value.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
