Briefing
A coordinated front-end attack targeted Aerodrome Finance and Velodrome, the leading decentralized exchanges on the Base and Optimism networks, by compromising their centralized Domain Name System (DNS) registrar. This DNS hijacking redirected users accessing the primary domain to a sophisticated phishing site, which then prompted them to sign malicious approve transactions, granting the attacker unlimited access to their digital assets. The core smart contracts and liquidity pools of both protocols remained secure, confirming the incident was an off-chain infrastructure breach. Initial on-chain forensics estimate the total user loss from compromised wallets to be in excess of $1 million.
Context
The DeFi ecosystem has a known, persistent vulnerability class rooted in reliance on centralized off-chain infrastructure, such as DNS providers and cloud services. This attack vector, which bypasses on-chain smart contract security, was previously exploited against Aerodrome in a similar 2023 breach. The prevailing risk was a failure to fully decentralize the user access point, leaving the domain registrar as a single point of failure susceptible to social engineering or administrative key compromise.
Analysis
The attack chain commenced with the compromise of the domain registrar, specifically Box Domains, which allowed the threat actor to maliciously alter the DNS records for aerodrome.finance and aerodrome.box. This manipulation redirected legitimate user traffic to an identical, attacker-controlled front-end interface. Once connected, the malicious site presented deceptive wallet prompts, beginning with an innocuous signature request and rapidly escalating to an aggressive demand for unlimited token approvals (e.g.
ETH, USDC, NFTs). By granting this permission, users effectively authorized the attacker’s wallet to drain their funds without needing a further transaction signature, successfully leveraging a centralized security lapse to execute an on-chain asset drain.
Parameters
- Total User Loss (Initial Estimate) → $1,000,000+ – The initial confirmed amount drained from user wallets in the first hour of the attack.
- Attack Vector → Centralized DNS Hijacking – The method used to redirect users from the legitimate domain to a malicious phishing site.
- Affected Protocols → Aerodrome Finance and Velodrome – Decentralized exchanges on the Base and Optimism Layer 2 networks.
- Vulnerability Type → External Dependency Flaw – A security failure in a third-party, centralized service (domain registrar) rather than the core smart contracts.
Outlook
Immediate mitigation requires all users who accessed the compromised domains to utilize a token approval revocation tool to nullify any recent malicious permissions. The incident serves as a critical stress test for DeFi’s reliance on centralized front-end components, accelerating the strategic shift toward mandatory decentralized access via technologies like the Ethereum Name Service (ENS). Protocols must now adopt a defense-in-depth posture that extends beyond smart contract audits to include robust, multi-factor security for all external infrastructure, including domain registrars and cloud services, to prevent this class of off-chain supply chain attack from becoming systemic.
