Rubic Hack

Reported loss $1.4M
Ethereum
Router Exploit

What happened

On December 25, 2022, an attacker drained USDC from Rubic users who had approved the RubicProxy contract on Ethereum. About $1.42 million was lost from roughly 49 wallets. Rubic had added the USDC token contract itself to RubicProxy's list of trusted routers. Because routerCallNative() forwarded arbitrary calldata to any whitelisted router, the attacker could make RubicProxy call USDC's transferFrom on users' approvals.

The attacker swapped the USDC to WETH on Uniswap, unwrapped it and sent about 1,100 ETH to Tornado Cash. Rubic paused its routing contracts a little over an hour after the attack started, told users to revoke approvals, and compensated affected users who contacted support. Revoke.cash notes that USDC still sits on the router whitelist of a paused contract, so old approvals remain risky if the contracts are ever unpaused.

How it happened

  1. Rubic added the USDC token address to the RubicProxy router whitelist (live page cites the add-router transaction 0x30679e7b6b410fb78368f5fb6e4c203e44d81c66ae9014c797e40856be1bbe66).
  2. The attacker called routerCallNative() with USDC as the router and calldata encoding transferFrom(victim, attacker, amount). The whitelist check passed because USDC was listed.
  3. RubicProxy made the call as the approved spender, so USDC moved from each victim that had approved RubicProxy to the attacker's contract.
  4. The attacker swapped the USDC to WETH, unwrapped it and moved about 1,100 ETH through Tornado Cash.

Protocol details

Classification Protocol Logic / Exchange (DEX) / Access Control
Protocol Type DEX Aggregator
Category Bridge Hack
Affected asset / contract RBC
Implementation language Solidity
Protocol links Website @CryptoRubic

Security review history

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Access Control Attacks Delegatecall & Call Injection Attacks

Same attack technique

Browse all hacks →
Hyperliquid L1 Hyperdrive HL $782K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes