Dexible V2 hack — February 2023

Dexible was a multichain DEX aggregator. On 17 February 2023 an attacker exploited its version 2 contracts and took $2,047,635.17 from traders who had granted those contracts token spending allowances.

The vulnerability was in the selfSwap function, which let a caller supply their own routing information so a trade could be sent to a venue of their choice. The router address was never checked against an approved list. The attacker passed a token contract address and hand-crafted calldata instead of a real router, so the Dexible contract executed transferFrom against allowances users had granted to Dexible and moved their tokens to an attacker-controlled address. Because the calls originated from the contract users had already approved, the token contracts permitted them.

Dexible's post-mortem recorded 17 affected trader addresses, four on Ethereum mainnet and 13 on Arbitrum; CoinDesk's account of the affected wallets gave a slightly different split of five and 13. The team said it discovered the problem when about $50,000 belonging to a founder moved unexpectedly, paused the contracts and told users to revoke their token approvals. Chief executive Michael Coon said the contracts had been paused while the team established a full picture of the situation.

The largest single loss fell on BlockTower Capital, which Arkham Intelligence and Nansen identified from wallet analysis as having lost about $1.5 million of TRU tokens. The attacker swapped TRU for ETH on SushiSwap and routed proceeds through Tornado Cash. Roughly 85 percent of the total came from a handful of large holders. No funds were recovered and no attribution has been established.