What happened
Hedgey's ClaimCampaigns contract was exploited after its locked-campaign path granted ERC-20 allowance to a user-supplied locker address. By creating and cancelling a campaign with an attacker-controlled locker, exploiters left approvals in place and used them to transfer campaign-token balances from the contract. The incident affected deployments chiefly on Ethereum and Arbitrum, with smaller copycat activity on other chains.
The widely cited $44.7 million total is notional and chiefly reflects illiquid BONUS tokens, so it should not be read as confirmed realized cash loss.
createLockedCampaign validated only that claimLockup.tokenLocker was nonzero, then increased the ERC-20 allowance for that address. cancelCampaign deleted campaign and lockup storage but did not revoke the allowance. Clearing application state therefore did not remove token-level authority, leaving an attacker-controlled locker able to pull ClaimCampaigns balances.
Case & protocol details
Attack Timeline
The Ethereum attacker flash-borrowed 1.305 million USDC from Balancer and created a locked claim campaign whose tokenLocker was an attacker-controlled contract. The creation flow increased that contract's allowance. The attacker immediately cancelled the campaign, withdrew the borrowed USDC, and repaid Balancer, but the allowance remained active.
In a second transaction, the malicious locker used transferFrom to remove 1,303,910 USDC from ClaimCampaigns. The pattern was repeated for NOBL and other campaign balances. The flash loan supplied temporary setup capital, while the underlying flaw was an untrusted-spender approval that survived campaign cancellation.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report twitter.com
- report Post-mortem medium.com
- transaction Transaction etherscan.io
- transaction Transaction arbiscan.io
- analysis Website reference twitter.com
- analysis Website reference twitter.com
- analysis Hedgey Finance Incident Analysis certik.com
- analysis Approval Error Vulnerability: Analyzing Hedgey Finance Exploit blog.verichains.io
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.