Unlock Protocol Hack

Reported loss $38K
Other

What happened

On April 21, 2023, an attacker drained a little over 20 ETH from Unlock Protocol on Ethereum. The main Unlock contract exposed postLockUpgrade() without checking who called it. The attacker used it to register their own contract as a deployed lock, which let that contract pass the onlyFromDeployedLock() check on recordKeyPurchase(). Only real Unlock locks are meant to call that function.

The exploiter contract 0xac08f1af4131480cc41ae89c80a63e578a152e84 then made about 70 transactions that day, sending WETH/ETH back to the attacker. About 16 ETH was moved to Tornado Cash through the accomplice address 0x3a6833329fc1bd0b867413045c5f6da3cb0e3c0e. ImmuneBytes reported that UDT's price fell more than 82% after the hack before recovering to a 37% drop.

Exploiter: Address 0x43ee…bb71

Exploiter contract: Address 0xac08…2e84

Setup transaction: Tx 0x4ac4…3ef6

How it happened

  1. The exploiter 0x43ee...bb71 deployed attack contract 0xac08...2e84.
  2. In transaction 0x4ac413c3...3ef6 (03:22 UTC), the attack contract called postLockUpgrade() on the Unlock implementation 0xdcb2...6b93. The function did not verify its caller, so it set locks[<0xac08>].deployed to true.
  3. Now registered as a deployed lock, the attack contract passed the onlyFromDeployedLock() modifier on recordKeyPurchase().
  4. The attacker ran the attack contract about 70 times on April 21, collecting a little over 20 ETH in total.
  5. About 16 ETH was sent to Tornado Cash through accomplice address 0x3a68...3c0e.

Protocol details

Classification NFT
Protocol Type Payments
Affected asset / contract UDT
Protocol links Website @UnlockProtocol

Evidence

Same attack technique

Browse all hacks →
SellToken $105K lost DD coin $307K lost MutantNFTs $25K lost Mycelium $300K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes