Unizen Hack

Reported loss $2.1M
Ethereum
User-controlled call through an approved swap aggregator to invoke transferFrom on victim allowances

What happened

A vulnerable upgraded Unizen trade-aggregator contract let an attacker drain tokens from users who had previously approved the aggregator. The loss was reported at about $2.1 million, initially in USDT and later converted to DAI.

Technical root cause

The upgraded aggregator permitted arbitrary external calls in its swap flow without binding the token source to msg.sender or enforcing trusted route targets. Existing ERC-20 approvals therefore gave the aggregator authority that attacker-supplied calldata could redirect from victims.

How it happened

The Ethereum aggregator proxy accepted user-supplied route targets and calldata in its swap path and executed them as the aggregator. It did not verify that the transferFrom source belonged to the caller or restrict calls to trusted routers. Because victims had approved the aggregator, the attacker supplied a transferFrom call for victim allowances and then forwarded the tokens to an attacker-controlled recipient.

The issue was discovered on March 8 and the approved aggregator remained a risk until users revoked approvals. This was a confused-deputy arbitrary-call flaw, not a flash-loan or oracle exploit.

Protocol details

Classification Arbitrary external call / approval drain
Protocol Type DEX Aggregator
Implementation language Solidity
Protocol links Website @unizen_io
Attacker Address 0x2aD8aed847e8d4D3da52AaBB7d0f5c25729D10df
Exploit Transaction 0x923d1d63a1165ebd35…089c765fcd

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Access Control Attacks Delegatecall & Call Injection Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes