Incident Overview
On October 18, 2024, Tapioca DAO suffered a social engineering attack that resulted in the compromise of two critical contracts stealing a total of 591 ETH and 2.8M USDC.
The attack was social engineering-based, allowing the attacker to seize ownership of the TAP vesting contract and claim 30M TAP tokens, leading to a sell-off that affected the TAP/ETH liquidity pool. Additionally, by taking control of the USDO stablecoin contract, the attacker added a malicious minter, enabling the infinite minting of USDO, which was then swapped for USDC and ETH, draining liquidity. The attacker successfully stole 591 ETH and 2.8M USDC before moving the funds.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Tapioca DAO, these are the critical security checks that could have prevented this incident (October 2024).
- Verify all logic paths related to Private Key Compromised (Social Engineering) / Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Tapioca DAO
The Tapioca DAO hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.