What happened
On June 25, 2025, an attacker took 224 ETH from SiloDAO through an unreleased leverage contract being tested on Ethereum. Contemporary estimates place the loss around $545,000 to $550,000. Silo's postmortem states that the money belonged to the DAO, not public users, and that the core markets and vaults were outside the affected module.
The leverage contract executed attacker-controlled swap calldata using its borrowing authority. The call could name a victim as borrower while directing the borrowed assets to the attacker.
How it happened
Testing had granted the leverage contract borrowing approval against the DAO's position. The attacker supplied _swapArgs targeting the legitimate WETH Silo market, but encoded a borrow operation instead of a swap. The leverage contract's external call then borrowed on the victim's behalf and sent the proceeds to the attacker's recipient address.
Silo paused the prerelease module on Ethereum and Sonic. The documented loss came from the Ethereum test position; deployment on two networks does not establish losses on both.
Reviewers should constrain the external target, operation, borrower, and recipient together. An approved contract must not lend its authority to arbitrary caller-supplied instructions.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
