Stake DAO Hack
What happened
On 12 March 2026, Stake DAO's Votemarket V2 peripheral oracle updater was exploited on Arbitrum and Base. A sender-validation bug let an attacker inject fabricated Ethereum block data, forge vote proofs, and claim campaign incentives across 54 campaigns. Stake DAO reported roughly $175,000 extracted; core protocol contracts and user deposits were not affected.
Authorization in L1BlockOracleUpdater.receiveMessage combined independent rejection conditions so that messages marked as Ethereum mainnet bypassed sender validation. Cross-chain chain identity and sender checks must be enforced independently before external data is accepted as oracle state.
How it happened
- The updater accepted a LaPoste cross-chain message as authorized whenever its chainId was Ethereum mainnet.
- That branch skipped sender validation, allowing an attacker to inject fabricated block data into the oracle.
- The attacker then supplied proofs against an attacker-controlled state root to register fictitious GaugeController vote data.
- With the oracle state poisoned, updateEpoch and claim distributed campaign incentives to the attacker.
- The disclosed failure was Stake DAO's sender-validation code; LaPoste and CCIP carried the forged message but are not the vulnerability being attributed here.
Protocol details
Security review history
- Pashov Audit Group View report
Evidence
Proof of concept
1 availableSources
- report Twitter/X Alert x.com
- report @StakeDAOHQ incident report x.com
- transaction Forged L1-to-Arbitrum message transaction etherscan.io
- transaction First Votemarket claim-flow transaction arbiscan.io
- analysis DeFiLlama defillama.com
- analysis Stake DAO incident disclosure stakedao.org
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
