What happened
FOOM Cash is a privacy-focused lottery game on Ethereum and Base that uses zk-SNARK proofs to hide player identities. On February 26, 2026, its withdrawal contracts on both chains were drained of about 24.28 trillion FOOM tokens, worth about $2.26 million. The cause was a broken Groth16 verifier. The protocol's snarkjs Phase 2 trusted setup had skipped the step that randomizes the gamma and delta verification-key constants. Both were left at the default BN254 G2 generator, which let anyone forge a valid-looking withdrawal proof from public inputs alone. The same flaw had been exploited at Veil Cash on Base days earlier. According to Rekt, security firm Decurity drained the Ethereum side and returned about $1.84 million the same day, and white hat duha drained the Base side. FOOM Cash paid duha a $320,000 bounty and Decurity a $100,000 fee. It reported recovering $1.84 million, about 81%, leaving a net cost of about $420,000.
Main Ethereum drain transaction: 0xce20448233f5ea6b6d7209cc40b4dc27b65e07728f2cbbfeb29fc0814e275e48
How it happened
- In a Groth16 verifier,
gammaanddeltamust be independent random points so that a proof cannot be built without a real witness. FOOM Cash's verifiers on Ethereum and Base had both set to the same default G2 generator, because the Phase 2 randomization step was never run. - With
gamma == delta, the pairing check reduces to an equation that anyone can satisfy. The drainer setA = alpha,B = betaandC = -vk_x, wherevk_xis computed only from the public inputs, and the verifier accepted it. - A helper contract called the withdrawal function in a loop. Each call used a new nullifier hash and a recomputed forged proof, so no deposit was ever needed.
- About 30 iterations emptied 99.99% of the Ethereum pool (about $1.84M), and about 10 emptied 99.97% of the Base pool (about $320K-$330K).
Protocol details
Evidence
- report @CertiKAlert incident report x.com
- report The Unfinished Proof - Rekt rekt.news
- analysis DeFiLlama defillama.com
- analysis FoomCash $1.6M Exploit (Faulty zk Verification - Explained) quillaudits.com
- analysis White hat helps recover $1.8M after $2.3M Foom Cash exploit (Cointelegraph via TradingView) tradingview.com
- analysis Front-running the Exploiter: A Technical Breakdown of the $1.84M Foom.cash White-Hat Rescue dev.to
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
