Socket Hack
What happened
Socket's Bungee protocol lost about $3.3 million from Ethereum user wallets after a newly added routing implementation allowed attacker-controlled calldata to invoke transferFrom against existing SocketGateway approvals. Socket later reported recovery of 1,032 ETH, worth about $2.3 million at the time.
WrappedTokenSwapperImpl.performAction directly executed caller-controlled swapExtraData without validating its calldata. The zero-WETH path bypassed the balance check, allowing arbitrary transferFrom calls to use pre-existing token approvals granted to SocketGateway.
How it happened
The attacker called SocketGateway's fallback routing selector through an attack contract. The gateway delegated to a newly added WrappedTokenSwapper route, whose performAction path executed caller-controlled swapExtraData without adequate validation.
A zero-WETH route bypassed the intended balance check and injected transferFrom calls against wallets that had approved SocketGateway. The attacker repeatedly drained approved USDC, WETH, USDT, WBTC, DAI, and MATIC from approximately 230 wallets.
Protocol details
Funds Recovery
Recovered
$2.3M
Net Loss
$999,900
Evidence
- report @SocketDotTech incident report twitter.com
- report Socket Incident Technical Breakdown rekt.news
- report SlowMist January 2024 Security Report slowmist.medium.com
- report Socket Recovery Announcement x.com
- analysis Web Archive archive.is
- analysis Website reference dlnews.com
- analysis DeFiLlama defillama.com
- analysis Socket Tech Incident Analysis certik.com
- analysis Socket protocol recovers two-thirds of stolen ETH from hack ct.com
- analysis Socket Says Bungee Protocol Was Exploited theblock.co
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
