What happened
Dough Finance's deleveraging connector was exploited through unvalidated external-call data. The attacker repaid a victim vault's debt, triggered withdrawal of its Aave collateral, and redirected the withdrawn WETH using the connector's call authority.
Technical root cause
ConnectorDeleverageParaswap failed to validate calldata in its deleveraging call chain. This exposed an arbitrary external-call path that could redirect assets withdrawn from user vaults.
How it happened
- Flash-loaned USDC repaid an affected DoughDsa vault's Aave debt.
- Crafted data entered the ConnectorDeleverageParaswap flashloanReq and deloop call chain.
- The deleveraging flow withdrew WETH collateral; another attacker-supplied call invoked transferFrom to send it to the attacker.
- The WETH was exchanged for USDC to repay the flash loan, and the process was repeated against other vaults.
Protocol details
Classification
Protocol Logic / Borrowing and Lending / Access Control
Protocol Type
Lending
Implementation language
Solidity
Protocol links
Website
@DoughFina
Evidence
Proof of concept
1 availableSources
- report Twitter/X Alert x.com
- report Report cointelegraph.com
- analysis DeFiLlama defillama.com
- analysis Dough Finance Incident Analysis certik.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
