DEUS Finance Hack

Reported loss $6.5M
Arbitrum BNB Chain Ethereum
Reversed allowance lookup

What happened

In May 2023, an allowance-handling error in the DEUS DEI stablecoin enabled unauthorized token transfers. Halborn estimated approximately $6.5 million taken across Arbitrum, BNB Chain and Ethereum.

Technical root cause

The burnFrom allowance lookup reversed the token owner and spender.

How it happened

  1. The attacker set an approval involving a DEI holder.
  2. Calling burnFrom with a zero burn amount read the allowance with owner and spender reversed, turning that approval into access to the victim's tokens.
  3. The attacker transferred tokens from victims. Halborn reported exploitation on Arbitrum, BNB Chain and Ethereum and some whitehat interception of transactions.

Protocol details

Classification Protocol Logic / Stablecoin / Token & Share Accounting
Protocol Type CDP
Affected asset / contract DEI
Implementation language Solidity
Protocol links Website @DeusDao

Security review history

  • CertiK 2021-06-23 No public report
Bug bounty Immunefi Protocol

Evidence

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes