Furucombo hack — February 2021

Furucombo, an Ethereum tool that let users chain together actions across DeFi protocols in a single transaction, was drained on 27 February 2021 at 16:47 UTC.

The protocol worked through a proxy contract that users granted token approvals to. That proxy maintained one whitelist covering both which contracts could call it and which contracts it could call, and the Aave V2 lending pool proxy was on the list. The attacker used Furucombo's batchExec function to delegatecall into the Aave proxy and invoke its initialize function, setting the attacker's own contract as the implementation inside Furucombo's storage context. A second call then routed Furucombo into the Aave proxy and on into the attacker's contract, which called transferFrom against every wallet still holding open approvals on Furucombo.

Because the theft hit users' own balances rather than protocol reserves, the damage was concentrated. Furucombo's post-mortem counted 22 affected users and 21 different assets. Furucombo put the total at $15 million; contemporaneous reporting used a $14 million figure drawn from early estimates, and the precise number is uncertain because the attacker moved the proceeds into Tornado Cash in instalments.

Furucombo removed the Aave V2 component from its registry, upgraded the proxy and registry contracts, and told users to revoke outstanding approvals. Victims were compensated not with returned assets but with 5 million rCOMBO claim tokens drawn against a recovery pool of 5 million COMBO, vesting linearly over 360 days from 1 March 2021. The attacker was never identified and none of the stolen funds were recovered.