What happened
On September 5, 2023, an attacker took 40.146 ETH from FloorDAO's treasury by abusing stale rebases in its FLOOR staking contract, a fork of Olympus V2. User funds were not affected. The ETH came out of the DAO's own FLOOR/WETH liquidity, about 0.8% of the treasury.
A rebase, which mints new FLOOR to stakers, could run every 8 hours. Activity had slowed, though, and the queue of pending rebases went back to May 17, 2023, so a large amount of undistributed supply was waiting. A bug inherited from the original Olympus V2 code made it worse: a rebase triggered by stake() counted the caller's new stake in the rebase calculation, which raised the amount distributed. The attacker flash-borrowed most of the FLOOR in the Uniswap V3 pool, repeatedly staked and unstaked to work through the backlog while holding most of the stake, and kept the newly minted FLOOR.
Within an hour FloorDAO pulled its Uniswap V3 and Charm Finance liquidity and turned off rebases by setting the distributor to the zero address. The attacker was funded through Tornado Cash and exited through it. The same technique was then used against other Olympus V2 forks, including Heavens Gate, Jump Farm and Quantum Wealth Network.
**Block data**
- Attacker:
0x4453aed57c23a50d887a42ad0cd14ff1b819c750 - Attack contract:
0x6ce5a85cff4c70591da82de5eb91c3fa38b40595 - Exploit transaction:
0x1274b32d4dfacd2703ad032e8bd669a83f012dde9d27ed92e4e7da0387adafe4 - Tornado Cash deposit:
0x3d3f30f81016d654b8d9a61cbd4ca19c0402fee04e02b711cb343f8eb311f3ac
How it happened
- The attacker flash-borrowed 152,089 FLOOR from FloorDAO's FLOOR/WETH Uniswap V3 pool.
- It staked the FLOOR, which triggered a pending rebase. Because of the inherited Olympus V2 bug, the rebase counted the fresh stake when sizing the distribution, and most of the new supply went to the attacker's large position. It then unstaked.
- It repeated stake-and-unstake 34 times, working through the rebase queue that went back to May 17, 2023.
- It repaid 153,610.711 FLOOR, including fees, to the pool and kept 14,606.145 FLOOR.
- It swapped that FLOOR for 40.146 ETH in the same pool, draining the DAO's liquidity, and later moved the funds through Tornado Cash.
Protocol details
Evidence
- report @artemDeDotFi incident report twitter.com
- report Floor Post Mortem & Incident Summary: September 5, 2023 medium.com
- transaction etherscan.io transaction 0x1274…afe4 etherscan.io
- transaction etherscan.io transaction 0x3d3f…f3ac etherscan.io
- address etherscan.io address 0x4453…c750 etherscan.io
- code DeFiHackLabs FloorDAO_exp.sol PoC github.com
- analysis Web Archive archive.ph
- analysis DeFiLlama defillama.com
- analysis FloorDAO Exploited for 40 $ETH ($65K) - Stolen Funds Funneled to TornadoCash blockchainreporter.net
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
