DAO ventures Hack

Reported loss $39K
Other

What happened

DAOventures, a DeFi robo-advisor, used the ChainSwap bridge to move its $DVG token between Ethereum and BNB Smart Chain. When ChainSwap was exploited on 10-11 July 2021, the attacker withdrew about 300,000 DVG (roughly $40,000) from ChainSwap's DVG vault and sold them on Uniswap. DAOventures' snapshot puts the start of the exploit just after block 12801522 (19:29 UTC on 10 July).

DAOventures' own contracts were not the target; its DAO Citadel and other strategies were unaffected. ChainSwap said a logic flaw in its bridge quota code let non-whitelisted addresses raise withdrawal quotas; about 20 assets worth roughly $4 million were taken across projects. ChainSwap froze DVG on BSC. DAOventures said it would replace DVG with a new $DVD token 1:1 based on the pre-exploit snapshot, including for buyers who bought after the exploit without knowing about it, and would build its own bridge.

Attacker transaction tracked by DAOventures (vault withdrawals, transfers and Uniswap sales): 0x348cfdb0817c0a7a6d3b17d0250ef2b72f24b2b7375e76a26f220910f3a1086c

How it happened

  1. ChainSwap's bridge let signer nodes raise a token's cross-chain quota automatically, so a valid claim needed signatures from addresses that had quota.
  2. Because of a logic flaw, addresses that were not whitelisted signers could also raise the quota. Rekt reports that the attacker called the bridge's receive function, supplying a fresh address as the signature in each call and paying only a small fee.
  3. The bridge accepted these claims and released about 300,000 DVG from its Ethereum vault.
  4. The attacker spread the DVG across wallets and sold it on Uniswap.

Protocol details

Classification Token
Protocol Type Exploit/Other
Affected asset / contract DVD
Protocol links Website @VenturesDao

Evidence

Same attack technique

Browse all hacks →
Umbrella Network $505K lost DAFI Protocol $200K lost Zapper $2.5M lost Cream Finance Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes