Swapp Protocol Exploit

On Sunday, 20th July 2025, an abandoned fork of Compound Finance called Swapp Protocol was successfully exploited for approximately $1.3 million USD¹.

Summary

Exploiter: 0x657a2b6Fe37CEd2F31fD7513095DBfb126a53601 via 0x7f1F536223d6a84Ad4897A675F04886cE1c3b7A1

Exploit Transaction: 0xa02b159fb438c8f0fb2a8d90bc70d8b2273d06b55920b26f637cab072b7a0e3e (Trace)

Exploit Chain: Ethereum Mainnet (1)

Exploited Codebase: Staking.sol @ 0x245a551ee0F55005e510B239c917fA34b41B3461²

Exploited Assets:

• Staking @ 0x245a551ee0F55005e510B239c917fA34b41B3461

Audits: CertiK, Chainsulting

CVSS 3.1 Score: 9.3 (Critical)

CVSS 3.1 Vector: AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N/E:F/RL:O/RC:C/CR:X/IR:H/AR:X/MAV:N/MAC:L/MPR:N/MUI:N/MS:C/MC:N/MI:H/MA:N

SWCs: SWC-104

Vulnerability

Older versions of Compound Finance's cToken ERC20 implementation do not revert on transfer failures but instead simply return false. A consequence of this is that the obligation is on the caller to explicitly check this return value and handle any errors. Swapp Protocol's fork of Compound's staking code does not do this. As such, the attacker attempted to transfer approximately 1.2 million cUSDC to the Staking contract. This obviously failed as the attacker did not actually possess this quantity of cUSDC tokens yet Swapp's code failed to handle this. The attacker then called Staking::emergencyWithdraw with the same quantity that they had (falsely) transferred into the Staking vault. This then drains the balance of the vault.

Exploit

The actual exploit occurs in transaction 0xa02b159fb438c8f0fb2a8d90bc70d8b2273d06b55920b26f637cab072b7a0e3e. This transaction deploys the exploit contract (0x7f1F536223d6a84Ad4897A675F04886cE1c3b7A1) and performs the actual exploit.

Notably, the attacker's EOA was funded via Railgun nearly a year prior to the exploit.

Timeline

Time	Event
2025-07-20T02:50:23+00:00	Exploit occurs in transaction 0xa02b159fb438c8f0fb2a8d90bc70d8b2273d06b55920b26f637cab072b7a0e3e
2025-07-21T06:34:00+10:00	User @deeberiroz posts about the hack on X/Twitter

Bibliography

[1] deebeez, “deebeez on X,” X (formerly Twitter), Jul. 21, 2025. [Online]. Available: https://x.com/deeberiroz/status/1947213692220710950. [Accessed: Jul. 22, 2025].

[2] A. Manning, “Solidity Security: Comprehensive list with known pitfalls, best practices, real world attacks and potential code snippets,” Sigma Prime Blog, May 30, 2018. [Online]. Available: https://blog.sigmaprime.io/solidity-security.html. [Accessed: Jul. 22, 2025].