Velocore V2 Hack

Reported loss $6.8M
Linea zkSync Era
Direct pool-state call to inflate fee state and mint excessive LP tokens through withdrawal underflow

What happened

Velocore V2's constant-product pools were exploited on Linea and zkSync Era after a pool function intended for Vault-controlled state changes could be called directly. Crafted inputs triggered unchecked fee arithmetic and a single-token-withdrawal underflow, allowing the attacker to mint outsized LP balances and redeem pool assets. Reported losses were approximately $6.8 million.

Technical root cause

The CPMM pool exposed velocore__execute without restricting the caller to the Vault, despite that function changing pool state intended to be Vault-controlled. Crafted values overflowed effectiveFee1e9 and pushed feeMultiplier outside its expected range. A single-token withdrawal then underflowed, enabling excessive LP-token minting and redemption.

How it happened

The attacker called a CPMM pool's velocore__execute function directly with crafted values. This altered fee state through unchecked arithmetic, raising the effective fee multiplier beyond its intended range. The malformed swaps then used a single-token-withdrawal underflow to mint an outsized LP-token balance.

The attacker redeemed those LP tokens to drain volatile pools on Linea and zkSync Era. Flash liquidity appeared in the broader extraction path, but the root issue was direct access to pool-state logic combined with unsafe fee and withdrawal arithmetic.

Protocol details

Classification Access-control failure / arithmetic and fee-accounting flaw
Protocol Type DEX
Implementation language Solidity
Protocol links Website @velocorexyz
Attacker Address 0x8CDc37eD79C5EF116b9Dc2A53Cb86ACaca3716bF
Exploit Transaction 0x37434e674efc4e7cfe…d286e35eb0

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Access Control Attacks Arithmetic Overflow & Underflow Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes