Dough Finance hack — July 2024

Dough Finance, an Ethereum protocol offering leveraged "looping" strategies built on top of Aave, was drained on 12 July 2024. The bug sat in ConnectorDeleverageParaswap, the contract that unwound leveraged positions. Its deleveraging path took a flash loan and then forwarded caller-supplied calldata to an external swap contract without validating it. CertiK's analysis found no validation anywhere in the call chain, which allowed an attacker to substitute calldata that made the connector call transferFrom on WETH and move user tokens straight out. Eight transactions were used. CertiK identified the attacker address. Published totals differ. Contemporary reports measuring the attacker's proceeds gave 608 ETH, about $1.8 million; CertiK's transaction-level analysis put the loss at roughly $2.1 million; Cointelegraph later described it as about $2.5 million. Dough Finance never published its own accounting, so the figure remains contested. The attacker, funded through Railgun, converted the stolen USDC into ETH and sent 600 ETH to Tornado Cash the following day. A white-hat address returned 69.12 ETH and the MEV bot c0ffeebabe.eth returned 7.05 ETH. Dough Finance posted an on-chain message giving the attacker until 23:00 UTC on 15 July 2024 to make contact before pursuing criminal and civil action; no return followed. The team announced a recovery plan based on a governance vote to redistribute recovered funds, compensation tokens and a burn-and-redeem mechanism. Cointelegraph reported in 2026 that the vote was never held, the tokens were never usable, and affected users received roughly $281,000 in total.