Unizen Hack

TOTAL LOST $2.1M
Medium Access Control Attacks Ethereum

What happened

A vulnerable upgraded Unizen trade-aggregator contract let an attacker drain tokens from users who had previously approved the aggregator. The loss was reported at about $2.1 million, initially in USDT and later converted to DAI.

Technical Root Cause

The upgraded aggregator permitted arbitrary external calls in its swap flow without binding the token source to msg.sender or enforcing trusted route targets. Existing ERC-20 approvals therefore gave the aggregator authority that attacker-supplied calldata could redirect from victims.

Case & protocol details

Classification Arbitrary external call / approval drain
Protocol Type DEX Aggregator
Smart Contract Language Solidity
Official Website www.unizen.io/
Protocol Twitter/X @unizen_io
Attacker Address 0x2aD8aed847e8d4D3da52AaBB7d0f5c25729D10df
Exploit Transaction 0x923d1d63a1165ebd35…089c765fcd

Attack Timeline

The Ethereum aggregator proxy accepted user-supplied route targets and calldata in its swap path and executed them as the aggregator. It did not verify that the transferFrom source belonged to the caller or restrict calls to trusted routers. Because victims had approved the aggregator, the attacker supplied a transferFrom call for victim allowances and then forwarded the tokens to an attacker-controlled recipient.

The issue was discovered on March 8 and the approved aggregator remained a risk until users revoked approvals. This was a confused-deputy arbitrary-call flaw, not a flash-loan or oracle exploit.

Evidence & learning

Attack pattern

Compare incidents →
Access Control Attacks Delegatecall & Call Injection Attacks

Proof of concept

1 available

Sources and on-chain records

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes