What happened
On December 21, 2021, an attacker minted about 195 million vVISR in Visor Finance's vVISR staking contract without depositing any VISR. The attacker then redeemed the vVISR for 8.8M VISR, worth about $8.2M at pre-hack prices. Dumping that VISR into Uniswap's VISR-ETH pool crashed the price by about 87%. The attacker received ETH and laundered it through Tornado Cash; Rekt counted 113 ETH (~$450k) at the time of writing.
The bug was in the staking contract's deposit(). It let the caller name any contract as the from address. Its only check was that from had an owner() method returning the caller. It then called delegatedTransferERC20 on that contract to pull the VISR, trusting whatever contract it was given. The attacker's contract passed the owner check, and its delegatedTransferERC20 moved no VISR but called deposit() again, so shares were minted twice for nothing.
Visor proposed a token migration based on a pre-exploit snapshot, promised refunds, and engaged Quantstamp and ConsenSys Diligence to audit the new staking contract.
Attacker: [0x8efab89b497b887cdaa2fb08ff71e4b3827774b2](Address 0x8efa…74b2)
Attack transaction: [0x69272d8c...](Tx 0x6927…ff3f)
Exploited contract: [0xc9f27a50f82571c1c8423a42970613b8dbda14ef](Address 0xc9f2…14ef)
How it happened
- The attacker, funded through Tornado Cash, deployed a contract whose
owner()returned the attacker and whosedelegatedTransferERC20moved no VISR. - The attacker called the staking contract's
deposit()with this contract asfromand a large VISR amount. The owner check passed. deposit()calleddelegatedTransferERC20on the attacker's contract, which calleddeposit()again instead of sending VISR. Both calls minted about 97.6M vVISR each, 195.25M vVISR in total.- The attacker redeemed the vVISR for 8.8M VISR from the staking contract.
- The attacker sold the VISR into Uniswap v2's VISR-ETH pool, crashing its price, and moved the ETH through Tornado Cash.
Protocol details
Evidence
- report @VisorFinance incident report twitter.com
- report @peckshield incident report twitter.com
- report @BlockSecTeam incident report twitter.com
- report Visor Finance - REKT rekt.news
- transaction Etherscan - exploit transaction 0x69272d8c... etherscan.io
- address etherscan.io address 0x8efa…74b2 etherscan.io
- address etherscan.io address 0x8efa…txns etherscan.io
- address etherscan.io address 0xc9f2…code etherscan.io
- analysis Visor Finance is hacked for about $8.2 million (Web3 is Going Great) web3isgoinggreat.com
- analysis bloxy.info page 0x8efa…74b2 bloxy.info
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
