Briefing
On May 28, 2025, Cork Protocol, a decentralized finance platform designed for depeg insurance, experienced a sophisticated exploit resulting in the loss of approximately $12.1 million in wstETH. The incident stemmed from a critical vulnerability within the protocol’s implementation of Uniswap V4 hooks, which allowed an attacker to bypass access controls and manipulate swap conditions. This enabled the unauthorized minting and redemption of derivative tokens, leading to the significant drain of 3,761 wstETH from the wstETH:weETH Liquidity Vault.
Context
Prior to this incident, Cork Protocol had accumulated $32 million across its Liquidity Vaults and undergone multiple security audits. Despite these measures, the inherent complexity of composable DeFi logic, particularly when integrating advanced features like Uniswap V4 hooks, presented an expanded attack surface. The protocol’s reliance on external smart contracts for custom logic, without sufficiently stringent internal validation and access control, created a latent vulnerability that adversarial actors could weaponize.
Analysis
The attack leveraged a critical flaw in Cork Protocol’s beforeSwap hook logic, which lacked proper access control and validation of user-supplied data. The attacker initiated the exploit by creating a malicious market and then used the Uniswap V4 Pool Manager’s unlockCallback feature to invoke CorkHook’s beforeSwap function with crafted, unauthorized hook data. This deceptive maneuver tricked the protocol into believing legitimate deposits were being made, facilitating the unauthorized minting of derivative tokens (Cover Tokens and Depeg Swaps). Subsequently, these fabricated tokens were redeemed for real underlying assets, specifically 3,761 wstETH, before the funds were laundered via Tornado Cash.
Parameters
- Protocol Targeted → Cork Protocol
- Attack Vector → Uniswap V4 Hook Manipulation / Missing Access Control
- Financial Impact → ~$12.1 Million (3,761 wstETH)
- Date of Incident → May 28, 2025
- Blockchain → Ethereum
- Attacker Funds Destination → Tornado Cash
Outlook
This exploit underscores the imperative for DeFi protocols to move beyond superficial audits and implement comprehensive economic and behavioral logic simulations, especially when integrating highly programmable features like Uniswap V4 hooks. Protocols must establish robust identity validation mechanisms for smart contract interactions and treat all external dependencies, including hedging tools and coverage platforms, as primary attack surfaces. Immediate mitigation for affected users involves monitoring for further suspicious activity, while the broader ecosystem must adopt enhanced security best practices to prevent similar sophisticated manipulations.
