Incident Overview
UnshETH suffered an access control exploit resulting in the loss of $375,000 $USD worth of farm rewards and protocol liquidity
UnshETH is a staking and yield protocol in Ethereum and Arbitrum chains. One of the deployer keys for auxiliary unshETH contracts (farms and bridge contracts) was compromised. The security teams narrowed down the scope of impact to USH farm rewards and protocol-owned liquidity.
Onchain message communication with the malicious actor was established for recovery purposes. Within two hours after being contacted by unshETH team members, the attacker responded with intentions to return control of all compromised contracts which were then transferred back to multisig addresses on each chain securing all impacted assets. The attacker had already recovered some assets and gained approximately 375,000 $USD in proceeds but negotiations are ongoing towards their retrieval in exchange for a 50,000 $DAI as a whitehat bounty.
During this incident, unshETH withdrawals were paused for 24 hours.
Malicious transaction:
https://etherscan.io/tx/0x2cf0c07d…3439d2
Onchain messages:
https://etherscan.io/tx/0x6b7d74b8…8565c3
https://etherscan.io/tx/0x7faade0b…09b37a
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to unshETH, these are the critical security checks that could have prevented this incident (May 2023).
- Verify all logic paths related to Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Certik Report
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next unshETH
The unshETH hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.