What happened
On December 23, 2024, MoonHacker vault contracts on Optimism were exploited for approximately $320,000 USDC. The affected vaults interacted with Moonwell markets, but the reporting says Moonwell's core lending pools were unaffected.
How it happened
- The attacker obtained a USDC flash loan from Aave.
- They called the vault's
executeOperationfunction with a malicious contract in place of a legitimatemToken. - Because the function neither validated that input nor restricted the caller, it granted the malicious contract a USDC approval.
- The attacker used that approval to drain vault USDC, then repeatedly repaid borrowing and redeemed collateral before repaying the flash loan.
Protocol details
Classification
Yield Aggregator / Protocol Logic / Access Control
Protocol Type
Exploit/Flash Loan Attack
Implementation language
Solidity
Evidence
Proof of concept
1 availableSources
- report Report binance.com
- report @dedaub incident report x.com
- analysis Blog reference blog.solidityscan.com
- analysis DeFiLlama defillama.com
- analysis MoonHacker Vault Hack Analysis blog.solidityscan.com
- analysis MoonHacker Vault Hack Analysis blog.verichains.io
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
