DEUS Finance (DEI stablecoin) hack — May 2023

On 5 May 2023 an attacker exploited a coding error in the DEI stablecoin contract issued by DEUS Finance and took roughly $6.5 million from token holders on Arbitrum, BNB Chain and Ethereum.

The contract's burnFrom() function checked the allowance mapping with its arguments in the wrong order, reading _allowances[msg.sender][account] rather than the ERC-20 standard _allowances[account][msg.sender]. An approval that user A had granted to user B was consequently interpreted as an approval that B had granted to A. Because burnFrom() was publicly callable, anyone could invoke it with a burn amount of zero against a victim's address, acquire spending rights over that victim's DEI, and transfer the tokens away. CertiK described the same inverted mapping and noted that its earlier audit of DEUS covered the project's AMM product, not the stablecoin contract that carried the bug.

Published totals differ. Halborn broke the losses down as about $5 million on Arbitrum, $1.3 million on BNB Chain and $135,000 on Ethereum; CertiK put the total at approximately $6.5 million; Cointelegraph and crypto.news, citing PeckShield, reported "over $6 million". The range is recorded here rather than a single figure.

DEUS paused its contracts, burned DEI on-chain and published a multisig address on Arbitrum for the return of funds. Several exploit transactions were front-run by white hats. Accounts of how much was salvaged also conflict: Halborn described roughly 10 percent being returned to the project, while DailyCoin reported a recovery multisig holding 2,023 ETH worth about $3.8 million plus $158,857 in DEUS and $702,370 in USDC. DEI, already trading below peg since 2022, fell a further 30 percent.