DAO Maker Vesting Hack

Reported loss $4.0M
Ethereum
Access Control Exploit

What happened

On 3-4 September 2021 an attacker drained DAO Maker's vesting contracts on Ethereum, taking about $4 million in vested public-sale tokens of four projects: DeRace (DERC), Showcase (SHO), Ternoa (CAPS) and CoinsPaid (CPD). The vesting contracts' init() function did not check the caller, so the attacker re-initialized four contracts with their own parameters, made themselves owner, and then called emergencyExit() to pull the tokens out.

The attacker, 0x2708cace7b42302af26f1ab896111d87faeff92f, withdrew tokens in these emergencyExit() transactions:

  • 0xcb5be97496995d58da6f97491845040547b878e53a7b71f907a13408f3a54e5f (about 13.5M CAPS)
  • 0x4c273c2403aafd97e4b553f0e381cf1c63e5f2efebbe2ded7642a06f2b68c879
  • 0x1692a57f19b5e8e4bc6a372ac3c83c77cd4a1ea78414377ea66d3d59f4a7d2b7
  • 0xdd0176475165b83c702d49a876d4dc888b73477ad8833582c72aa6ca5e0bacc3 (about 20.6M SHO)

The tokens were then sold for DAI through DEX aggregators in these transactions:

  • 0xbf38346aacf261f5e169a87ed874c33c21efb060c4a393e2b1443a3ac5d6e3fd
  • 0x3436af2c84d67254a4b81adc350c91d1b98ae52b2ff84645d14d4245c2d08c27
  • 0xc586a6b94e09556abf46ae3aa8cffa8e46dfcb0c22bce0b024d5e01743ceba9e
  • 0x76163daf6cf0c815c02fb1a98f5c6283ee7a922cbad41218eb7a6452c91824c8

The affected tokens fell sharply after the dumps. DAO Maker said it would stop running smart contracts that hold user or project assets and would buy tokens on the market so affected sale participants still received their tokens in later releases. Rekt reported that this was DAO Maker's second exploit in about a month.

How it happened

  1. DAO Maker's vesting contracts held locked public-sale tokens for DeRace, Showcase, Ternoa and CoinsPaid.
  2. The contracts' init() function had no caller authentication, so anyone could call it again after deployment.
  3. The attacker called init() on four vesting contracts, overwriting their key parameters and setting themselves as owner in the same call.
  4. As owner, the attacker called emergencyExit(receiver) on each contract, sending the whole token balance to their own address.
  5. The attacker sold the tokens for DAI through DEX aggregators, crashing the affected token prices.

Protocol details

Classification Protocol Logic / Other / Access Control
Protocol Type Services
Affected asset / contract DAO
Implementation language Solidity
Protocol links Website @TheDaoMaker

Security review history

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Access Control Attacks

Same attack technique

Browse all hacks →
BNB Chain LaunchZone $700K lost Solana Crema Finance $8.8M lost BNB Chain Poly Network $611M lost Ethereum DODO AMM $3.8M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes