What happened
On 12 March 2026, Stake DAO's Votemarket V2 peripheral oracle updater was exploited on Arbitrum and Base. A sender-validation bug let an attacker inject fabricated Ethereum block data, forge vote proofs, and claim campaign incentives across 54 campaigns. Stake DAO reported roughly $175,000 extracted; core protocol contracts and user deposits were not affected.
Authorization in L1BlockOracleUpdater.receiveMessage combined independent rejection conditions so that messages marked as Ethereum mainnet bypassed sender validation. Cross-chain chain identity and sender checks must be enforced independently before external data is accepted as oracle state.
Case & protocol details
Attack Timeline
The updater accepted a LaPoste cross-chain message as authorized whenever its chainId was Ethereum mainnet. That branch skipped sender validation, allowing an attacker to inject fabricated block data into the oracle. The attacker then supplied proofs against an attacker-controlled state root to register fictitious GaugeController vote data.
With the oracle state poisoned, updateEpoch and claim distributed campaign incentives to the attacker. The disclosed failure was Stake DAO's sender-validation code; LaPoste and CCIP carried the forged message but are not the vulnerability being attributed here.
Evidence & learning
Proof of concept
1 availableSources and on-chain records
- report Report x.com
- transaction Transaction etherscan.io
- transaction Transaction arbiscan.io
- analysis Twitter/X Alert x.com
- analysis Stake DAO incident disclosure stakedao.org
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.