Briefing
A critical security incident unfolded at Aerodrome Finance, where attackers successfully executed a DNS hijacking attack against the protocol’s centralized domain registrar. This compromise rerouted legitimate users to a sophisticated phishing interface, resulting in the mass signing of malicious token approval transactions that granted the attacker unlimited asset access. The core consequence is direct user fund loss, as the exploit bypassed the security of the underlying smart contracts entirely. Forensic analysis suggests the immediate loss exceeded $1 million from compromised user accounts.
Context
The prevailing security posture in decentralized finance has often over-prioritized smart contract audits while under-securing off-chain dependencies. This incident highlights the persistent, known risk of centralized single points of failure, such as domain registrars and front-end hosting. The vector leveraged is a classic supply chain attack, where a weakness in a third-party service provider compromises the entire user experience.
Analysis
The attack vector compromised the protocol’s centralized domain registrar, Box Domains, allowing the attacker to seize control of the.finance and.box domains. This domain takeover facilitated the redirection of user traffic to a malicious, visually identical phishing site. Users interacting with this fraudulent interface were prompted to execute a two-stage attack → first, a seemingly innocuous signature request, immediately followed by an aggressive, high-risk request for unlimited token approvals (e.g.
ETH, USDC). The success of the exploit hinged on leveraging the user’s trust in the front-end to authorize the approve() function, thereby granting the attacker permission to drain the approved assets.
Parameters
- Key Metric → Over $1 Million – The estimated total value siphoned from compromised user wallets.
- Attack Vector → DNS Hijacking – The method used to redirect users to the malicious phishing site.
- Affected Component → Centralized Domain Registrar – The specific third-party service that was compromised to initiate the attack.
- Affected Network → Base – The blockchain network where the victim protocol primarily operates.
Outlook
Immediate mitigation requires all users who accessed the site during the incident window to revoke token approvals immediately using external tools like Revoke.cash. The contagion risk is high for any protocol relying on centralized DNS or front-end infrastructure, necessitating a rapid shift toward decentralized front-end hosting solutions such as ENS mirrors. This event will likely establish a new security best practice mandating the adoption of a fully decentralized user access layer to eliminate the centralized domain registrar as a single point of failure.
Verdict
This DNS hijacking definitively proves that a protocol’s security perimeter must extend beyond the smart contract layer to encompass all centralized off-chain infrastructure that manages user access and trust.
