Briefing
The Aerodrome Finance decentralized exchange was compromised through a sophisticated DNS hijacking attack, redirecting users from the legitimate Web2 frontend to a malicious phishing site. This attack bypassed smart contract security by leveraging social engineering to trick users into signing malicious “unlimited approval” transactions. The immediate consequence was the draining of user wallets across multiple assets, resulting in a total loss of over $1 million.
Context
The prevailing risk factor was the protocol’s fundamental reliance on a centralized Domain Name Service (DNS) provider for its primary user interface. This common Web2 dependency represents a critical, often-overlooked attack surface, as it shifts the security perimeter from the audited smart contract to the less secure domain registration infrastructure.
Analysis
The attacker executed a DNS hijacking by modifying the protocol’s domain records via a third-party registrar, pointing the official URL to a malicious clone of the frontend. When users connected their wallets, the phishing site prompted them to sign a transaction that appeared benign but was, in reality, an approve call granting the attacker unlimited spending allowance on their assets. Once the signature was captured, the attacker immediately used the unlimited approval to drain all approved tokens (ETH, USDC, WETH) from the compromised user wallets.
Parameters
- Total Funds Drained → Over $1 million in user assets (ETH, WETH, USDC) were siphoned from compromised wallets.
- Root Cause → DNS Hijacking via a third-party domain registrar compromise (NameSilo insider threat).
- Affected Protocol Version → Aerodrome Finance Web2 Frontend (The underlying smart contracts were not exploited).
- Immediate Mitigation → Protocol team disabled the compromised Web2 frontend and directed users to the secure Ethereum Name Service (ENS) mirror.
Outlook
Protocols must immediately shift their security architecture to prioritize decentralized naming services like ENS over traditional DNS to eliminate this critical Web2 attack vector. Users are advised to revoke all unlimited token approvals and to verify the authenticity of all frontend URLs via decentralized channels. This incident reinforces that smart contract security is insufficient; the entire Web2-to-Web3 interface must be secured against supply chain attacks.
Verdict
This DNS hijacking incident serves as a definitive operational proof that a protocol’s weakest link remains its centralized Web2 infrastructure, not the on-chain smart contract code.
