What happened
Linear Finance's lAAVE minting authority was granted to an attacker-linked contract through its access-control system. That contract then minted a large quantity of lAAVE. AntChain Open Labs traced the role grant to an earlier transfer of administrator privileges.
Technical root cause
A malicious contract received legitimate minting privileges through the administrator-controlled ISSUE_ASSET role. AntChain Open Labs suspected compromise of the former administrator's private key, but did not establish how the initial access occurred.
How it happened
- Administrator privileges were transferred to a new address.
- The new administrator granted ISSUE_ASSET authority to an attacker-linked contract.
- The attacker called that contract's mintToken function.
- Its lAAVE mint call passed the role check because the malicious contract had already received the required authority.
Protocol details
Classification
Stablecoin / Token
Protocol Type
Derivatives
Affected asset / contract
lUSD
Protocol links
Website
@LinearFinance
Security review history
- CertiK View report
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
