Revert Finance Hack

What happened

Revert Finance's V3Utils contract exposed users' token allowances through an unrestricted swap-router parameter. Attackers drained approved balances on several networks. Revert disabled the affected feature, urged users to revoke approvals, and refunded affected users with token airdrops.

Technical root cause

V3Utils did not restrict the swapRouter target to trusted swap contracts. Arbitrary token calls executed with its spending authority, exposing unused allowances granted by users.

How it happened

1. V3Utils accepted a dynamic router address supplied with swap parameters.
2. The attacker substituted a token contract as the router and supplied a malicious call.
3. The token call ran with V3Utils as the spender, allowing previously approved user balances to be transferred.
4. Revert disabled the frontend feature and issued refunds; remaining allowances still required revocation or protective action.

Protocol details

Classification Yield Aggregator / Access Control

Protocol Type Exit Scam/Abandoned

Implementation language Solidity

Protocol links Website @revertfinance

Security review history

Bug bounty Immunefi Protocol

Funds Recovery

100.0%

Recovered

$30K

Net Loss

$0

Evidence

• report @revertfinance incident report twitter.com
• report Post-mortem mirror.xyz
• analysis DeFiLlama defillama.com
• analysis An attack on V3Utils paragraph.com

Understand the attack patterns

Compare incidents →

Access Control Attacks Delegatecall & Call Injection Attacks