What happened
On 2021-11-24 dYdX deployed a new proxy contract that converted other tokens to USDC and deposited them into the exchange in one transaction. A flaw in it let anyone spend the token allowances that depositors had granted the proxy. A member of a trading firm reported the bug at 05:21 UTC on 2021-11-27.
By then about 700 addresses had allowances on the proxy, and about 180 of them held roughly $2M that could be taken. dYdX and Paradigm researchers ran a white-hat rescue through Flashbots that moved the vulnerable funds into an escrow contract only the original owners could withdraw from. They also disabled deposits in the UI and warned users to revoke approvals.
According to the post-mortem, frontrunner bots took an estimated $211,000 from approved wallets (it later lists $206,134.87 plus 1.5 WETH); it does not say when or exactly how. dYdX said it would reimburse those losses, pay users' gas for revoking and withdrawing, and pay a 500,000 USDC bug bounty.
How it happened
- Users depositing through the new proxy approved it to spend their ERC-20 tokens, often with large allowances.
- The proxy's conversion function accepted a caller-supplied
exchangeaddress and calldata and executedexchange.call(data)without checking that the target was a trusted exchange. - An attacker could pass a token contract as
exchangeand encodetransferFrom(victim, attacker, amount)asdata. The proxy then called the token itself and spent the victim's allowance. - After the report, dYdX and Paradigm used the same path to rescue about $2M into escrow. Separately, frontrunner bots took an estimated $211K from approved wallets.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
