Bent Finance hack — December 2021

Bent Finance, a yield optimiser built on top of Curve and Convex, disclosed on 21 December 2021 that funds had been drained from its cvxCRV and MIM reward pools. The protocol said the transactions originated from its own deployer address, which roughly three weeks earlier had pushed an unverified contract update assigning a very large token balance to an address the updater controlled. That hardcoded balance allowed the holder to claim rewards far in excess of anything deposited. Verified code was redeployed afterwards, hiding the change until anomalies in reward distribution were noticed.

Withdrawals ran from around 12 December until roughly 04:50 UTC on 21 December 2021. Published losses vary. Fraud investigator Joe McGill counted about 440 ETH, worth over $1.6 million at the time. Token-denominated accounts put it at roughly 512,700 cvxCRV, valued in different reports at between $1.75 million and $2.1 million.

Bent Finance disabled reward claims, told users to withdraw, and said it consulted outside researchers, including samczsun, before concluding the update had been inserted by someone with internal access. The project's contracts were mid-migration to multisig ownership at the time. No individual has been named, charged, or has admitted responsibility, so the insider account rests on the project's own conclusion and on PeckShield's observation that the activity came from the deployer address.

Within days the party holding the funds returned assets to a project multisig. Because the returned mix of ETH and DAI fell short of the token value, community members contributed a further 200,000 cvxCRV. Bent Finance said reimbursement of 512,696.06 cvxCRV-f was paid in full on 24 December 2021.