Dolomite (legacy Ethereum contract) hack — March 2024

Dolomite's current markets run on Arbitrum, but a version of the exchange deployed on Ethereum mainnet in 2019 and decommissioned in 2020 was still live on chain. On 20 March 2024 an attacker used it to drain wallets that had never revoked their old token approvals. CertiK flagged the activity publicly, and Dolomite disabled the faulty contract, suspended the legacy system and told users to revoke approvals. Dolomite's post-mortem sets out the mechanism. The legacy product settled trades through Loopring's ring-matching contracts, and users' approvals sat on the Loopring Trade Delegate. Loopring's code returned a non-zero value rather than reverting, so an order whose state was coerced to look filled, with order.filledAmountS set to ~uint256(0), had its signature validation skipped; invalid orders were never included in rings and so escaped further validation. The attacker submitted such invalid orders through submitRingsThroughDyDx alongside two genuine orders, which moved victims' balances into the DolomiteMarginExchange contract and back out in exchange for a nominal amount of LRC. Cointelegraph characterised the flaw as a bypass of a reentrancy guard and Quantstamp grouped it under token-approval exploits caused by insufficient validation; the official account is a skipped signature check. Dolomite recorded 1,245,271 USDC, 94,423 DAI and 165.9 WETH taken from 187 addresses, totalling about $1.8 million. Cointelegraph reported that the proceeds were transferred to an attacker wallet, and deposited into Tornado Cash. Dolomite's post-mortem states that by 15:44:35 UTC on 24 March 2024 it had recovered 90% of the assets taken by the exploiter, without saying how. The treasury covered the remaining 10%, and all victims were repaid on 26 March 2024, with the three restitution transaction hashes published.