What happened
Punk Protocol's August 2021 fair launch was exploited after its CompoundModel contracts allowed their initialize function to be called repeatedly. The attacker reinitialized the investment strategy through delegatecall, replaced the privileged forge address with an attacker-controlled contract, then used forge-only withdrawal functions to drain the USDC, USDT, and DAI pools. A whitehat front-ran part of the attack and later returned most of what it captured under a negotiated finder’s fee.
The `initialize` function had no initializer guard and could be invoked repeatedly. Because initialization also set the protocol's forge address, an attacker could overwrite that privileged address through delegatecall. The `withdrawTo` and `withdrawToForge` functions were restricted to `onlyForge`, but the attacker had made their own contract the forge, turning the access-control check into an attacker-controlled permission.
Case & protocol details
Attack Timeline
The attacker targeted CompoundModel contracts used by the fair launch. They invoked initialize through delegatecall and supplied an attacker-controlled forge address. Because no initializer guard prevented reinitialization, the modified forge address was accepted. The attacker then called the forge-only withdrawTo and withdrawToForge paths to withdraw the three stablecoin pools.
A whitehat observed the attack and front-ran a portion of the exploit, withdrawing the DAI and USDT before the original attacker could. The original attacker retained the USDC pool and a later DAI withdrawal, while the whitehat negotiated a 1 million DAI fee and returned the remaining captured funds to a safe wallet for participant compensation.
Funds Recovery
Recovered
$5.0M
Net Loss
$3,991,717
Evidence & learning
Sources and on-chain records
- report Post-mortem medium.com
- report Post-mortem medium.com
- report Post-mortem rekt.news
- report Post-mortem medium.com
- report Post-mortem rekt.news
- transaction Transaction etherscan.io
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.