What happened
On September 1, 2023, an attacker exploited SharedStake's sgETH liquid staking token on Ethereum. A missing ownership check let anyone take control of sgETH, grant themselves the minter role and mint sgETH without depositing ETH. The attacker redeemed the unbacked tokens against the ETH buffered in the minter contract.
SharedStake put the loss at about 105 ETH, limited because rollovers were batched and little ETH sat in the minter. The team disabled the stake and rollover interfaces, paused the minter, asked vETH2 holders to withdraw from the Rollover contract, and messaged the attacker on-chain offering a 10% whitehat fee for returned funds. The team described the new contract as unaudited.
How it happened
- The
sgETHcontract exposed an ownership function without a proper caller check, so any address could make itself (or a contract it controlled) the owner/admin. - From that position the attacker granted the minter role to a contract they controlled.
- The new minter minted
sgETHto the attacker with no ETH collateral behind it. - The attacker redeemed the unbacked
sgETHthrough the real minter contract, withdrawing the ETH it held for legitimate stakers (about 105 ETH in total across two exploiter addresses).
Protocol details
Security review history
- CertiK View report
Evidence
- report @spreekaway incident report twitter.com
- report Sharedstake Exploit postmortem Sep 1/2023 (Chimera Defi, SharedStake) medium.com
- transaction Etherscan transaction 0x0e57d49c...b9f44 etherscan.io
- analysis DeFiLlama defillama.com
- analysis AI Agent Smart Contract Exploit Generation (Gervais, Zhou), Fig. 2 sgETH case arxiv.org
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
