Punk Protocol Hack
What happened
Punk Protocol's August 2021 fair launch was exploited after its CompoundModel contracts allowed their initialize function to be called repeatedly. The attacker reinitialized the investment strategy through delegatecall, replaced the privileged forge address with an attacker-controlled contract, then used forge-only withdrawal functions to drain the USDC, USDT, and DAI pools. A whitehat front-ran part of the attack and later returned most of what it captured under a negotiated finder’s fee.
The initialize function had no initializer guard and could be invoked repeatedly. Because initialization also set the protocol's forge address, an attacker could overwrite that privileged address through delegatecall. The withdrawTo and withdrawToForge functions were restricted to onlyForge, but the attacker had made their own contract the forge, turning the access-control check into an attacker-controlled permission.
How it happened
The attacker targeted CompoundModel contracts used by the fair launch. They invoked initialize through delegatecall and supplied an attacker-controlled forge address. Because no initializer guard prevented reinitialization, the modified forge address was accepted. The attacker then called the forge-only withdrawTo and withdrawToForge paths to withdraw the three stablecoin pools.
A whitehat observed the attack and front-ran a portion of the exploit, withdrawing the DAI and USDT before the original attacker could. The original attacker retained the USDC pool and a later DAI withdrawal, while the whitehat negotiated a 1 million DAI fee and returned the remaining captured funds to a safe wallet for participant compensation.
Protocol details
Funds Recovery
Recovered
$5.0M
Net Loss
$3,991,717
Evidence
- report Punk Protocol Fair Launch Incident Report medium.com
- report Post-mortem medium.com
- report Post-mortem rekt.news
- report Punk Compensation Plan and the Path Forward medium.com
- report Punk Protocol rekt.news
- transaction Punk Protocol Original Attack Transaction etherscan.io
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
