What happened
On 23 July 2024 an attacker used an arbitrary-call bug in Spectra Finance's router contract on Ethereum to take tokens from users who had approved the router. Spectra said the attack began around 15:00 UTC and hit some users depositing and withdrawing through the app. It disabled the app, terminated the router contracts, and said the core protocol contracts and the funds in them were safe.
The router let a caller have it make a call of the caller's choosing. The attacker used that to make the router call transferFrom on tokens that users had approved to it. One reproduced transaction took a victim's whole asdCRV balance, worth about $73,000. Spectra's incident report, as summarised by SlowMist, said four wallets were affected, with total losses of about 168 ETH (roughly $550,000). The app was restored on 24 July.
How it happened
- Users of the Spectra app had given ERC-20 approvals to the Spectra router (
0x3d20601ac0Ba9CAE4564dDf7870825c505B69F1a) so it could move their tokens during deposits and withdrawals. - The router's command-based
executeentry point (selector0x3593564c) accepted a command (0x12in the reproduction) that made the router call an attacker-supplied target with attacker-supplied calldata, without restricting either. - The attacker set the target to the asdCRV token and the calldata to
transferFrom(victim, attacker, victimBalance). Because the router was the approved spender, the token transferred the victim's balance to the attacker (tx0x491cf8b2a5753fdbf3096b42e0a16bc109b957dc112d6537b1ed306e483d0744). - The attacker repeated this against other wallets that still had approvals on the router, until Spectra disabled the app and terminated the router.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
