Gamma Hack
What happened
On 21 December 2021, an attacker exploited Visor Finance's Ethereum RewardsHypervisor staking contract, which issued vVISR shares for deposited VISR. By supplying a malicious contract as the deposit source, the attacker caused the contract to mint vVISR without receiving the stated VISR deposit, then redeemed the shares for approximately 8.81 million VISR. Contemporary security analysis valued the loss at about $8.2 million.
RewardsHypervisor trusted an attacker-controlled external hook for deposit authorization and custody transfer, and minted shares without verifying the actual VISR balance increase. The hook was reentrant, allowing `deposit` to be invoked again before the initial state transition completed.
Case & protocol details
How it happened
The deposit flow accepted a caller-selected from contract. It trusted that contract to report its owner and move the claimed VISR deposit, then minted vVISR based on the declared amount without measuring whether VISR had actually reached the staking contract. The attacker supplied a malicious source contract whose callback re-entered deposit instead of transferring the assets.
That allowed an additional share mint before the original call completed. The attacker subsequently redeemed 195.25 million improperly minted vVISR for about 8.813 million VISR. This was not merely an unchecked token-return-value issue: the protocol allowed untrusted code to participate in deposit authorization and asset transfer, while reentrancy compounded the unbacked minting.
Security review history
- ConsenSys Diligence Report
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Post-mortem medium.com
- transaction Visor attack transaction etherscan.io
- transaction Visor withdrawal transaction etherscan.io
- analysis SharkTeam: Visor Finance exploit analysis sharkteam.org
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
