Briefing
The Hedgey Finance protocol suffered a catastrophic economic exploit targeting its token vesting contracts. This attack leveraged a logic flaw in the TokenLockup contract, allowing the threat actor to repeatedly claim tokens that should have been released only once, resulting in an immediate and total loss of locked capital. The primary consequence is the systemic failure of all active vesting schedules, with the total financial impact estimated at $44.5 million across Arbitrum and Ethereum.
Context
Token vesting and time-lock mechanisms represent a high-value, high-risk attack surface due to the large capital pools they manage. Prior to this incident, the industry had documented risks associated with complex state-change logic in transfer functions, particularly in custom contract implementations that deviate from battle-tested standards. This exploit capitalized on the systemic risk inherent in unaudited or insufficiently tested custom token handling logic.
Analysis
The compromise stemmed from a flaw within the release function of the TokenLockup contract. The attacker initiated a transaction that triggered the token transfer but manipulated the call stack to prevent the internal state variable, which tracks the released amount, from updating before the transfer was completed. This re-entrancy-like condition allowed the threat actor to execute the token withdrawal multiple times within a single transaction, effectively draining the entire vested balance before the contract could register the initial release. The attack was successful because the contract’s internal state update was not executed before the external token transfer call.
Parameters
- Key Metric → $44.5 Million → Total value of assets drained from the vesting contracts across multiple chains.
- Vulnerability Type → Logic Flaw → The exploit leveraged an error in the sequential execution of the release function.
- Affected Chains → Arbitrum and Ethereum → The primary networks hosting the exploited vesting contracts.
Outlook
Immediate mitigation requires all users and protocols leveraging Hedgey’s contracts to cease interaction and initiate a forced contract upgrade or migration to a verified, patched implementation. The primary second-order effect is a renewed scrutiny of all custom vesting and time-lock contracts, particularly their handling of external calls and state updates, which will likely establish new best practices for pre-transfer state-locking. This incident reinforces the necessity of formal verification for any contract managing significant time-locked capital.
Verdict
This catastrophic logic failure in a core vesting primitive demonstrates that even simple time-lock contracts require the highest level of formal verification to prevent systemic economic exploitation.
