What happened
Velocore V2's constant-product pools were exploited on Linea and zkSync Era after a pool function intended for Vault-controlled state changes could be called directly. Crafted inputs triggered unchecked fee arithmetic and a single-token-withdrawal underflow, allowing the attacker to mint outsized LP balances and redeem pool assets. Reported losses were approximately $6.8 million.
The CPMM pool exposed velocore__execute without restricting the caller to the Vault, despite that function changing pool state intended to be Vault-controlled. Crafted values overflowed effectiveFee1e9 and pushed feeMultiplier outside its expected range. A single-token withdrawal then underflowed, enabling excessive LP-token minting and redemption.
Case & protocol details
Attack Timeline
The attacker called a CPMM pool's velocore__execute function directly with crafted values. This altered fee state through unchecked arithmetic, raising the effective fee multiplier beyond its intended range. The malformed swaps then used a single-token-withdrawal underflow to mint an outsized LP-token balance.
The attacker redeemed those LP tokens to drain volatile pools on Linea and zkSync Era. Flash liquidity appeared in the broader extraction path, but the root issue was direct access to pool-state logic combined with unsafe fee and withdrawal arithmetic.
Evidence & learning
Proof of concept
1 availableSources and on-chain records
- report Report x.com
- report Velocore Incident Post-Mortem velocorexyz.medium.com
- report Post-mortem medium.com
- report Post-mortem rekt.news
- transaction Transaction lineascan.build
- transaction Transaction explorer.zksync.io
- analysis Twitter/X Alert x.com
- analysis Website reference x.com
- analysis Website reference x.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.