Briefing
A high-value user of the Goldfinch protocol was compromised, resulting in the unauthorized transfer of approximately $330,000 in Ethereum from their personal wallet. The exploit vector was not a direct protocol vulnerability but rather a previously signed malicious token approval that granted a third-party contract unlimited spending permission over the user’s assets. The attacker successfully leveraged this standing permission to execute a transferFrom function, immediately siphoning 118 ETH and subsequently laundering the stolen funds through Tornado Cash.
Context
The prevailing attack surface for individual users remains token approval risk, where users grant contracts the right to spend their tokens via the ERC-20 approve() function. This incident highlights the systemic danger of perpetual or excessive token allowances that persist long after the intended transaction is complete. The user’s assets were exposed due to a failure in maintaining a zero-trust security posture regarding external contract interactions.
Analysis
The attack was executed by calling the transferFrom function on the user’s tokens, a function only callable by an address that holds a prior token allowance, or “approval,” from the asset owner. The attacker’s address, or an intermediary contract, was the designated spender in a previously signed, high-risk, or compromised approval transaction. This allowed the attacker to bypass the need for a fresh signature from the user for the withdrawal itself, effectively turning a token allowance into a standing order for theft. The success of the drain was predicated on the user failing to revoke this malicious approval after the initial interaction.
Parameters
- Total Loss → $330,000 (The approximate USD value of the stolen assets)
- Asset Stolen → 118 ETH (The quantity of Ethereum drained from the user wallet)
- Exploit Type → Malicious Token Approval (Leveraging a standing ERC-20 allowance)
- Funds Destination → Tornado Cash (A crypto mixer used for obfuscation)
Outlook
Immediate mitigation requires all users to audit and revoke all unnecessary or unlimited token approvals granted to third-party smart contracts, especially those associated with a suspicious contract address. This incident will accelerate the push for widespread adoption of tools like Revoke.cash and for wallets to implement more granular, time-bound, and transaction-specific approval limits by default. The contagion risk is low for the Goldfinch protocol itself but extremely high for any user who maintains a lax approach to token allowance management across the DeFi ecosystem.
