CoW Swap loses over $100k in exploit

CoW Swap, a peer-to-peer decentralized exchange (DEX) or aggregator in a protocol exploit, lost $150k to an attacker via the settlement contract. 

According to CoW Swap, the attack only impacted the fees that CoW Protocol has collected over the past week, however, traders are not affected. The team urged users on CoW Swap not to revoke approvals and assured the attack didn’t access users’ funds. 

The CoW Swap settlement contract only stores fees that the protocol accumulated over the week. Before an attack impacts users’ funds, an order signed by the user is provided, without it, there cannot be direct access to the user funds, CoW Swap explained. 

Smart contract audit platform, Block Sec analyzing the attack on Twitter, said the suspected address was added as a “solver” of CoW Swap by the multisig tx. Further, the address invoked the tx to approve DAI to SwapGuard. Cow Swap reporting the export said, “a hacker exploited an external solver and used it to drain the settlement contract, which held 7 days worth of protocol fees.” CoW Swap also said that the damages will be paid for by the solver’s bond.

Moreso, the attacker initiated a transfer to arbitrary addresses by asking SwapGuard to transfer DAI from GPv2Settlement since DAI was approved from GPv2Settlement to SwapGuard. Other approved tokens (USDT, USDC, and ETH) in the process were as well transferred to the attacker. 

The root cause of the attack identified by Block Sec was that a contract with the interface of arbitrary call had an allowance, which resulted in the address being able to approve the maximum value of DAI to SwapGuard.

CoW Swap assures the team has mitigated the issues and launched an investigation following the attack.

Read also; 

Binance to suspend USD bank transfers

What do you think of this article? Share comments below.