What happened
On 21 December 2021, an attacker exploited Visor Finance's Ethereum RewardsHypervisor staking contract, which issued vVISR shares for deposited VISR. By supplying a malicious contract as the deposit source, the attacker caused the contract to mint vVISR without receiving the stated VISR deposit, then redeemed the shares for approximately 8.81 million VISR. Contemporary security analysis valued the loss at about $8.2 million.
RewardsHypervisor trusted an attacker-controlled external hook for deposit authorization and custody transfer, and minted shares without verifying the actual VISR balance increase. The hook was reentrant, allowing deposit to be invoked again before the initial state transition completed.
How it happened
- The deposit flow accepted a caller-selected
fromcontract. - It trusted that contract to report its owner and move the claimed VISR deposit, then minted vVISR based on the declared amount without measuring whether VISR had actually reached the staking contract.
- The attacker supplied a malicious source contract whose callback re-entered
depositinstead of transferring the assets. - That allowed an additional share mint before the original call completed.
- The attacker subsequently redeemed 195.25 million improperly minted vVISR for about 8.813 million VISR.
- This was not merely an unchecked token-return-value issue: the protocol allowed untrusted code to participate in deposit authorization and asset transfer, while reentrancy compounded the unbacked minting.
Protocol details
Security review history
- ConsenSys Diligence View report
Evidence
- report Post-mortem medium.com
- transaction Visor attack transaction etherscan.io
- transaction Visor withdrawal transaction etherscan.io
- analysis DeFiLlama defillama.com
- analysis SharkTeam: Visor Finance exploit analysis sharkteam.org
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
