Incident Overview
A Uniswap liquidity provider was subjected to a phishing attack, which incurred losses of $8M. Uniswaps smart contracts were not involved in any shape or form in this phishing attack.
The victim received a fake airdrop of a lp token from the attacker disguised as a transaction coming directly from Uniswap. The attacker manipulated the trade log in order to make "Uniswap" appear as the sender of the transaction on blockscan.
The attacker set up a fake airdrop claim website upfront. When the victim tried to claim the airdrop on the phishing website, approvals were given to the attacker that enabled the hacker to gain control over the funds of the victims wallet.
The hacker exited a WBTC/USDC liquidity pool position the victim had established on Uniswap and exchanged assets for $ETH, which were withdrawn through Tornado.cash.
Uniswap was not the target of this attack, nor were any of Uniswaps smart contracts affected in this exploit.
The fake airdrop token address: https://etherscan.io/address/0xcf39b779…2ed00c
Creator of the malicious fake airdrop tokens address: https://etherscan.io/address/0x24a4b33b…2c6fd6
Hacker wallet address: https://etherscan.io/address/0x09b5027e…447afa
Callling multicall for swapping $WBTC and $USDC to $ETH transaction: https://etherscan.io/tx/0x49efa8a1…02ce2d
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Uniswap, these are the critical security checks that could have prevented this incident (July 2022).
- Verify all logic paths related to Phishing are guarded by proper access controls and input validation - see the Phishing Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
- 01
- 02
- 03
- 04
- 05
- 06
Learn to Prevent the Next Uniswap
The Uniswap hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.