Hedgey Hack
What happened
Hedgey's ClaimCampaigns contract was exploited after its locked-campaign path granted ERC-20 allowance to a user-supplied locker address. By creating and cancelling a campaign with an attacker-controlled locker, exploiters left approvals in place and used them to transfer campaign-token balances from the contract. The incident affected deployments chiefly on Ethereum and Arbitrum, with smaller copycat activity on other chains.
The widely cited $44.7 million total is notional and chiefly reflects illiquid BONUS tokens, so it should not be read as confirmed realized cash loss.
createLockedCampaign validated only that claimLockup.tokenLocker was nonzero, then increased the ERC-20 allowance for that address. cancelCampaign deleted campaign and lockup storage but did not revoke the allowance. Clearing application state therefore did not remove token-level authority, leaving an attacker-controlled locker able to pull ClaimCampaigns balances.
How it happened
The Ethereum attacker flash-borrowed 1.305 million USDC from Balancer and created a locked claim campaign whose tokenLocker was an attacker-controlled contract. The creation flow increased that contract's allowance. The attacker immediately cancelled the campaign, withdrew the borrowed USDC, and repaid Balancer, but the allowance remained active.
In a second transaction, the malicious locker used transferFrom to remove 1,303,910 USDC from ClaimCampaigns. The pattern was repeated for NOBL and other campaign balances. The flash loan supplied temporary setup capital, while the underlying flaw was an untrusted-spender approval that survived campaign cancellation.
Protocol details
Security review history
- Hacken View report
- ConsenSys Diligence View report
- Salus View report
Evidence
- report @hedgeyfinance incident report twitter.com
- report @CertiKAlert incident report twitter.com
- report @peckshield incident report twitter.com
- report Hedgey Exploit Post-Mortem medium.com
- transaction Ethereum Exploit Transaction etherscan.io
- transaction Arbitrum Exploit Transaction arbiscan.io
- analysis DeFiLlama defillama.com
- analysis Hedgey Finance Incident Analysis certik.com
- analysis Approval Error Vulnerability: Analyzing Hedgey Finance Exploit blog.verichains.io
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
