ForceDAO Hack

Reported loss $367K
Ethereum
Other

What happened

On April 4, 2021, hours after its token launch, ForceDAO's xFORCE staking vault was drained of FORCE tokens worth about 183 ETH (~$367,000). The vault was forked from SushiSwap's xSUSHI, which assumes a failed token transfer reverts. FORCE is an Aragon MiniMe token that returns false on a failed transferFrom instead, and the vault never checked that return value.

Five addresses exploited the bug: four black-hat attackers and one whitehat who alerted the team. ForceDAO said a standard OpenZeppelin ERC-20 or a safeTransferFrom wrapper would have prevented it, then used governance votes to burn the FORCE held by three attacker addresses. FORCE fell about 97% after the incident.

How it happened

  1. The attacker made a deposit into the xFORCE vault that was set up to fail, so the FORCE token's transferFrom did not move any tokens.
  2. The MiniMe FORCE token returned false instead of reverting, and the vault did not check the return value.
  3. The vault minted xFORCE shares to the attacker as if the deposit had succeeded.
  4. The attacker redeemed those unbacked xFORCE shares for real FORCE deposited by other users.

Protocol details

Classification Other / Token & Share Accounting
Protocol Type Exploit/Other
Affected asset / contract FORCE
Implementation language Solidity
Protocol links Website @force_dao

Funds Recovery

100.0%

Recovered

$367K

Net Loss

$0

Evidence

Same attack technique

Browse all hacks →
BNB Chain Venus $2.2M lost BNB Chain LABUBU $120K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes