Velora Legacy Approval Hack
What happened
The October 2025 Velora incident concerns a reported $20,000 USDC loss from a wallet with an outstanding approval to the old Augustus V6 router. It is a later exposure to the router vulnerability disclosed under the ParaSwap name in March 2024, not evidence of a newly discovered flaw in Velora's current contracts.
The original Augustus V6 uniswapV3SwapCallback lacked adequate caller validation in some paths. An attacker-created pool could use the callback to spend tokens approved to the vulnerable router.
How it happened
The 2024 postmortem explains the callback flaw and the rescue operation conducted at that time. The October 2025 alert concerns a wallet whose old approval remained usable. Retiring a router from an interface does not revoke token allowances already recorded on-chain.
Keep the two events separate: the 2024 rescue and reimbursement totals are not recoveries for this $20,000 case. A wallet review should identify the exact approved spender and its remaining allowance, rather than assume that a protocol rebrand or interface upgrade removed historical exposure.
Protocol details
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
