What happened
On 6 January 2026, a legacy IPOR USDC Fusion Optimizer vault on Arbitrum was exploited for about $336,000 USDC. The incident combined a delegated admin account with an arbitrary-call-capable EIP-7702 delegate and missing validation of withdrawal fuse modules in the legacy vault.
Sensitive vault configuration relied on privileged delegated execution while the legacy withdrawal path did not strictly validate fuse modules. Arbitrary-call-capable delegated authority could therefore configure attacker-controlled logic.
How it happened
A privileged administrator EOA had delegated execution to a contract exposing arbitrary external calls. The attacker used that authority to configure a malicious fuse in the legacy vault and invoked the withdrawal flow. Because the vault did not strictly validate the configured fuse, it executed attacker-controlled logic and transferred assets out.
IPOR's postmortem states the necessary conditions were unique to this legacy vault; the incident should not be represented as an EIP-7702 protocol flaw or a compromise of all Fusion vaults.
Protocol details
Security review history
- BlockSec View report
Evidence
- report @CertiKAlert incident report x.com
- report @ipor_io incident report x.com
- report IPOR Fusion Optimizer postmortem blog.ipor.io
- transaction Fusion exploit transaction arbiscan.io
- analysis DeFiLlama defillama.com
- analysis Lookonchain: IPOR Fusion Arbitrum vault hack lookonchain.com
- analysis Blockaid: IPOR Fusion monitoring partnership blockaid.io
- analysis SlowMist Arbitrum incident record hacked.slowmist.io
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
