Dexible Hack

Reported loss $2.0M
Arbitrum Ethereum
Access Control

What happened

On February 17, 2023, Dexible v2 was exploited for roughly $2 million from users who had approved its swap contracts to spend their tokens. The opened analysis reports 17 affected traders across Ethereum and Arbitrum.

How it happened

  1. The attacker submitted a selfSwap route with attacker-controlled router information and call data.
  2. Dexible's fill path accepted that router without an on-chain verification check.
  3. The attacker used the authorized Dexible contract to call token transferFrom against users who had already granted it allowances, moving their tokens to the attacker.

Protocol details

Classification Exchange (DEX) / Protocol Logic / Access Control
Protocol Type Exploit/Access control
Implementation language Solidity
Protocol links Website @DexibleApp

Security review history

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Access Control Attacks Delegatecall & Call Injection Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes