What happened
On December 2, 2025, attackers exploited a legacy Goldfinch test contract deployed before the protocol's public launch, draining about $330,000 USDC through a false loan-repayment path that could draw against users' token allowances.
A legacy test contract retained a false-repayment path that could pull USDC from wallets with an allowance set for that contract. The vulnerable deployment remained live even though the issue had been fixed before Goldfinch's public launch.
How it happened
Goldfinch's governance forum explains that a September 2020 test contract contained a critical issue that had been fixed before public launch but was never patched on the old deployment. The attacker could make a false loan repayment using a victim address and collect the resulting interest, allowing USDC to be taken up to each affected wallet's allowance for the contract. Goldfinch disabled the legacy contract after the incident and proposed using $250,000 from its bug-bounty budget toward victim reimbursement; that proposal is not recorded here as recovered funds.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
