What happened
On April 23, 2024, Magpie Protocol reported that a vulnerability in MagpieRouterV2 let an attacker bypass a router security check and divert approximately $129,000 from 221 wallets. The team paused the dApp, patched the router, and said all affected users were fully reimbursed with the original asset on the affected chain within two weeks.
How it happened
- The attacker targeted MagpieRouterV2's function-selector handling and bypassed the router's security check.
- The bypass let the attacker divert funds from 221 wallets to the attacker's address, with Magpie reporting approximately $129,000 taken.
- Magpie paused and shut down the dApp, fixed the vulnerability, and later reimbursed affected users with their original assets on the chains where they were lost.
Protocol details
Classification
Protocol Logic / Input Validation
Protocol Type
DeFi Protocol
Implementation language
Solidity
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
