How much was lost in the Velocore V2 hack?

The Velocore V2 hack resulted in $6.8M in losses on June 02, 2024.

What attack technique was used in the Velocore V2 exploit?

The Velocore V2 exploit utilized Fee Overflow Exploit / Other. Understanding this attack vector is critical for smart contract auditors and developers building secure DeFi protocols.

How can developers prevent similar smart contract attacks?

Preventing smart contract hacks requires a combination of secure coding practices, thorough security audits, and understanding common attack vectors like reentrancy, oracle manipulation, and access control flaws. Smart Contract Hacking (SCH) provides hands-on training to help developers and auditors identify and prevent vulnerabilities before deployment.

Velocore V2 Hack

TOTAL LOST $6.8M

Medium Jun 02, 2024 Fee Overflow Exploit / Other linea zksync era

Affected Chain linea 2 chains affected

Recovered - No recovery reported

All-Time Rank #380 By amount stolen

Protocol Type Dexs Target category

Incident Overview

Quick Summary

On June 2 Velocore was exploited and loss worth $6.8 million.

Details of the Exploit

On June 2, 2024, Velocore experienced a security breach that resulted in the loss of approximately $6.8 million in ETH. The breach was due to vulnerabilities within the Balancer-style CPMM pool contract, particularly faulty logic in the velocore__execute() function and issues with the fee rate calculation logic that allowed effectiveFee1e9 to exceed 100%. Additionally, there was a potential underflow issue during single-token withdrawals and a lack of caller verification in the velocore__execute() function.

The attacker used funds from Tornado Cash, executed the exploit, bridged the funds through Across Bridge, and redeposited them back into Tornado Cash. While all volatile pools in Linea and zkSyncEra Velocore were affected, stable pools and the Telos Velocore pools were not impacted as the issue was mitigated beforehand. The Blade fork of Velocore, which uses a different pool structure, was also unaffected.

The team acknowledged the critical assistance from Hexagate, Hypernative, and Ironblock in identifying and addressing the exploit. Further updates and a detailed post-mortem are forthcoming.

Block Data Reference

Final Fund Destination Address:

Exploiter EOAs:

Exploiter Contracts:

Attack txs:

https://lineascan.build/tx/0xed11d5b0…cdbed1

https://lineascan.build/tx/0x37434e67…e35eb0

https://explorer.zksync.io/tx/0x4156d73c…11ba17

This is classified as a Arithmetic Overflows Underflows . Compare similar hacks →

Incident Report

Protocol / Project Velocore V2

Date of Incident June 02, 2024

Affected Chain(s) linea zksync era

Attack Technique Fee Overflow Exploit / Other

Classification Protocol Logic / Exchange (DEX)

Primary Source View Post-Mortem

Protocol Information

Protocol Type Dexs

Smart Contract Language Solidity

Official Website velocore.xyz/

Protocol Twitter/X @velocorexyz

Team Anonymous

Source Code Unverified

What the Attacker Needed to Succeed

Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.

Technical Knowledge Deep understanding of fee overflow exploit / other and Solidity and EVM internals

Capital Required Seed capital to cover gas and initial position setup

On-Chain Access Ability to interact with linea, zksync era smart contracts and deploy a custom exploit contract

Protocol Analysis Identification of the exploitable vulnerability in Velocore V2's contract logic - root cause: protocol logic / exchange (dex)

Execution Speed Precise transaction ordering and timing to exploit the vulnerability within a single atomic block

Obfuscation Plan A strategy to launder and move stolen funds - typically through mixers, cross-chain bridges, or decentralized DEX swaps to resist tracing

What Auditors Should Check

Could this have been caught in audit? Likely — with a thorough Fee Overflow Exploit / Other audit checklist and test coverage

If you're auditing a protocol with similar architecture to Velocore V2, these are the critical security checks that could have prevented this incident (June 2024).

Verify all logic paths related to Fee Overflow Exploit / Other are guarded by proper access controls and input validation - see the Arithmetic Overflows Underflows attack class for patterns
Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs

Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.

Free Trial

Related Attack Classes

The technique used in this hack maps to these vulnerability classes in our security curriculum:

See all Arithmetic Overflows Underflows examples →

Arithmetic Overflows Underflows

Proof-of-Concept Exploits

1 PoC available

poc-exploits - velocore v2

$ VeloCore lack-of-access-control

On-Chain Evidence & References

Twitter/X Alert https://x.com/BeosinAlert/status/1797247874528645333

Sources & References

01
Source 1 https://x.com/velocorexyz/status/1797229772399067587
02
Reference https://x.com/BeosinAlert/status/1797168817292148943
03
Reference https://x.com/velocorexyz/status/1797117286270353883

Threat Assessment

Severity Level

MEDIUM

Attack Vector Fee Overflow Exploit / Other
Root Cause Protocol Logic / Exchange (DEX)
Year 2024

Learn to Prevent the Next Velocore V2

The Velocore V2 hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.

Start Free Trial Browse Attack Library