Furucombo Hack
What happened
On February 27, 2021, an attacker abused Furucombo's proxy and Aave V2 integration to execute attacker-controlled code in Furucombo's storage context. The malicious code used Furucombo's existing user token approvals to drain ETH and ERC-20 assets from affected users.
Caller and callee authorization were conflated, allowing a whitelisted upgradeable proxy to become a delegatecall gadget. An uninitialized implementation slot in Furucombo's storage let the attacker redirect execution to arbitrary code.
How it happened
Furucombo used one registry check for both permitted proxy callers and permitted proxy callees. Because the Aave V2 lending-pool proxy was valid in that registry, the attacker delegatecalled it from Furucombo and invoked its initialization path. The initialization wrote the attacker implementation address into the Furucombo proxy's storage, after which the Aave proxy delegatecalled the malicious implementation.
That code could call transferFrom using the Furucombo proxy's user-approved allowances.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
