Incident Overview
Revert Finance was exploited via the allowances issue. Roughly 30,000 $USD worth of funds were stolen from the user's wallets.
Revert Finance is a Yield Aggregator which provides tools for various AMMs in four chains - Ethereum, Polygon, Arbitrum, and Optimism. The project's V3Utils contract that was deployed on 3 February 2023 was exploited, allowing the attacker to drain user funds. The total stolen amount is nearly 30,000 $USD, where the majority is 22,983 $USDC.
All the lost funds were compensated to the affected users as airdrops.
Attacker address:
https://etherscan.io/address/0x38f887a0…f32f70
Malicious contract:
https://etherscan.io/address/0xd346f652…61fb27
Malicious transaction:
https://etherscan.io/tx/0xdaccbc43…3f31d5
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Revert Finance, these are the critical security checks that could have prevented this incident (February 2023).
- Verify all logic paths related to Abandoned are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialFunds Recovery
Recovered
$30K
Net Loss
0
Sources & References
Learn to Prevent the Next Revert Finance
The Revert Finance hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.