What happened
On February 27, 2021, an attacker abused Furucombo's proxy and Aave V2 integration to execute attacker-controlled code in Furucombo's storage context. The malicious code used Furucombo's existing user token approvals to drain ETH and ERC-20 assets from affected users.
Caller and callee authorization were conflated, allowing a whitelisted upgradeable proxy to become a delegatecall gadget. An uninitialized implementation slot in Furucombo's storage let the attacker redirect execution to arbitrary code.
Case & protocol details
Attack Timeline
Furucombo used one registry check for both permitted proxy callers and permitted proxy callees. Because the Aave V2 lending-pool proxy was valid in that registry, the attacker delegatecalled it from Furucombo and invoked its initialization path. The initialization wrote the attacker implementation address into the Furucombo proxy's storage, after which the Aave proxy delegatecalled the malicious implementation.
That code could call transferFrom using the Furucombo proxy's user-approved allowances.
Evidence & learning
Sources and on-chain records
- report Report twitter.com
- report Post-mortem medium.com
- report Post-mortem rekt.news
- analysis The Furucombo Incident Analysis: Cascading Trust peckshield.medium.com
- analysis Furucombo Exploited for $14M theblock.co
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.