OAK — OnChain Attack Knowledge

Worked example · 2020-12

Cover Protocol Blacksmith infinite-mint exploit — Ethereum — 2020-12-28

Loss
approximately $4M of realised damage at peak, with ~40 quintillion (≈4×10^19) COVER tokens materialised against a designed circulating supply on the order of 100,000 tokens before the exploit. The COVER price collapsed approximately 97% within hours of the exploit transaction (08:08:12 UTC, 2020-12-28), as the dilution made the existing supply schedule meaningless. The white-hat operator known as grap.finance claimed responsibility and returned 4,350 ETH (≈$3M+ at the time) to Cover Protocol's treasury within hours; an additional smaller share was returned by other addresses subsequently. Cover Protocol's post-mortem and migration plan (snapshot-based 1:1 migration to a new COVER token contract) was the load-bearing recovery mechanism; the residual loss was absorbed by the protocol via the migration discount on attacker-extracted tokens that had reached exchange order books before the response.
OAK Techniques observed
OAK-T5.003 (Hidden-Mint Dilution) — primary, in the smart-contract-platform-level vulnerability variant scoped explicitly in the T5.003 page: a balance-tracking / reward-accounting bug in the Blacksmith staking contract let the attacker materialise COVER token supply against the contract's bookkeeping without an explicit retained mint-role being exercised. The defender-observable effect — totalSupply of the COVER token diverging dramatically from the published tokenomics in a single block — is the canonical T5.003 signature. OAK-T9.002 (Flash-Loan-Enabled Exploit) is not load-bearing here; the exploit did not require a flash loan, it required only enough capital to deposit a single 1-wei position into the mis-calculated reward formula. OAK-T9.005 (Reentrancy) is not the failure mode; the mint-amplifier bug was a stale-cache / unsynchronised-storage error in the reward-calculation path, not a reentrancy across an external call. The case is therefore the cleanest 2020 anchor for the T5.003 smart-contract-bug-driven hidden-mint variant, distinct from the explicit-mint-role variant covered by the SPL Token-2022 cohort.
Attribution
pseudonymous. The white-hat operator grap.finance (pseudonymous, but a publicly-known white-hat in the 2020 DeFi cohort) claimed responsibility on-chain via the return-of-funds transaction with an embedded message, returning the majority of extracted ETH to the Cover Protocol treasury. Cover Protocol's official post-mortem confirmed the return. Forensic providers PeckShield and Mudit Gupta (independent EVM forensics) published function-and-line-level reconstructions of the Blacksmith.sol bug within 24 hours, triangulating the root cause. ImmuneBytes published a follow-up auditor-side analysis. No criminal proceedings; the white-hat-return shape is structurally complete for the cohort.
Key teaching point
the T5.003 "supply-expansion" defender signal is detectable independently of whether the underlying mechanism is an explicit retained mint-role or a smart-contract-platform-level accounting bug. The Cover case is the canonical 2020 worked example for the second variant. A defender monitoring totalSupply reconciliation against the published emission schedule would have flagged the December 28 exploit within the same block in which the dilution occurred — the divergence between expected supply (~100K) and post-exploit supply (~40 quintillion) is forty-six orders of magnitude. The structural lesson for T5.003 contributors is that the Mitigation surface (continuous on-chain totalSupply reconciliation against published tokenomics) generalises across the explicit-mint-role and smart-contract-bug variants — both produce the same defender-observable artefact even though the upstream mechanism differs entirely. The Cover case sits alongside the Rari Capital / Fei Fuse exploit (2022-04, T9.005-with-T5.003-effect, ~$80M) as the canonical anchor pair for the smart-contract-bug variant of T5.003 across the 2020–2022 cohort.

Summary

Cover Protocol launched in late 2020 as a peer-to-peer DeFi cover (insurance) marketplace on Ethereum. The COVER token had a designed maximum supply on the order of 100,000 tokens, distributed via the Blacksmith staking contract that calculated and minted COVER as time-and-deposit-weighted staking rewards.

On 2020-12-28 at 08:08:12 UTC, an attacker exercised a bug on line 118 of the Blacksmith.sol smart contract. Per the public function-level reconstruction by Mudit Gupta and PeckShield: the contract cached the pool's per-pool data in a memory variable to save gas, updated the per-pool data in storage during the deposit flow, but failed to update the cached memory variable; subsequent reward-calculation reads continued to use the stale cached data, which produced an "amplifier" effect proportional to the difference between the depositor's stake size and the pool's total lpTokens immediately before the deposit.

The attacker constructed a deposit pattern that maximised the amplifier: a deposit of 1 wei into a pool with a large pre-deposit lpTokens total produced a reward calculation magnified by the ratio of lpTokens / 1 wei — on the order of 10^18× for typical pool sizes. Repeated executions of the deposit-and-claim loop within a single transaction materialised approximately 4×10^19 COVER tokens to the attacker's address, against a designed circulating supply on the order of 100,000.

The realised attacker extraction (≈$4M) was bounded by destination-pool-liquidity on Uniswap and 1inch — the COVER price collapsed ~97% within hours as the attacker dumped a portion of the materialised tokens into the order book. The pseudonymous white-hat operator grap.finance claimed responsibility within hours and returned 4,350 ETH (≈$3M+ at the time) to the Cover Protocol treasury via an on-chain transaction with an embedded message ("Next time. Take care of your own shit."). The recovery posture was structurally similar to the contemporary 2020 Origin Dollar case (white-hat-style return after dump-window).

Cover Protocol's response had two phases: (a) within hours, the team revoked the Blacksmith contract's mint authority on the COVER token, transferring it to a dummy contract that could no longer execute mint operations; (b) over the following days, the team announced a snapshot-based 1:1 migration to a new COVER token contract, where pre-exploit holders received the new token at the pre-exploit balance and exchange order-book holders who had purchased post-exploit COVER from the attacker were excluded from the migration. The migration was the load-bearing recovery; the dilution itself was unrecoverable at the contract layer.

The case is OAK's canonical 2020 worked example for the T5.003 smart-contract-platform-level supply-expansion variant. The bug was not in an explicit retained mint-role (which would be the canonical T1-side T5.003 signal — mint(address,uint256) callable by an unrenounced authority); it was in a reward-calculation cache that the protocol's design assumed would always be synchronous with storage. The defender-observable effect — totalSupply of the COVER token diverging by forty-six orders of magnitude from the published tokenomics in a single block — is the canonical T5.003 signature regardless of the upstream mechanism.

Why this is structurally significant

Three structural features distinguish the Cover Protocol case within the broader T5.003 cohort:

  1. The mint-amplifier was structurally bounded only by uint256 arithmetic, not by tokenomics. A defender computing maximum-possible-mint-from-bug under the explicit-mint-role variant of T5.003 might calibrate against the published emission schedule (e.g., "max 100K COVER ever"); the smart-contract-bug variant has no such bound — the amplifier scales with lpTokens / depositSize, and the depositor controls depositSize. The case is the clearest 2020 evidence that defender signals for T5.003 cannot rely on the tokenomics-stated cap as a hard ceiling for the smart-contract-bug variant; they must rely on continuous reconciliation against the expected emission trajectory, not against the terminal cap.

  2. The white-hat-return outcome partially obscured the structural lesson at the time. Because grap.finance returned the bulk of the realised extraction within hours, contemporary coverage focused on the social dynamics (white-hat etiquette, the embedded "take care of your own shit" message) rather than on the structural defender lesson. T5.003 contributors should treat the recovery shape as orthogonal to the technique-level lesson — the bug's defender-observable signal (totalSupply divergence) was identical whether or not the funds were returned, and a defender's detection latency does not depend on the attacker's eventual cooperativeness.

  3. Cache-vs-storage staleness as a systemic 2020 DeFi class. The Blacksmith bug pattern (memory cache of pool state, storage update without cache update, downstream reads using stale cache) was not unique to Cover — it is a recurring DeFi class through 2020–2022 wherever protocols cache state for gas savings without strict cache-invalidation discipline. Contributors writing future T5.003 cases under this variant should treat cache-staleness as a first-class detection-engineering surface alongside reentrancy and access-control errors.

The case generalises across the 2020–2022 hidden-mint-by-platform-bug cohort. The Rari Capital / Fei Fuse 2022-04 case (≈$80M reentrancy-into-mint on Compound v2 fork bookkeeping; T9.005-with-T5.003-effect per techniques/T5.003-hidden-mint-dilution.md) is the closest cohort companion. Cover anchors the 2020 cache-staleness sub-pattern at smaller dollar scale; Rari/Fei anchors the 2022 reentrancy-into-bookkeeping sub-pattern at headline scale. Together they bracket the smart-contract-bug variant of T5.003 across the early-DeFi cohort.

Timeline (UTC)

When Event OAK ref
2020-Q4 Cover Protocol launches; Blacksmith staking contract deployed with the cached-pool-data reward calculation (genesis surface)
Pre-2020-12-28 Bug present in Blacksmith.sol line 118; not surfaced in pre-deployment review (standing T5.003 surface)
2020-12-28 08:08:12 Attacker executes deposit-and-claim loop with 1-wei position; materialises ~4×10^19 COVER tokens T5.003 execution (smart-contract-bug variant)
2020-12-28 (within hours) Attacker dumps a portion into Uniswap / 1inch order books; COVER price collapses ~97%; realised extraction ~$4M T5 outflow
2020-12-28 (within hours) grap.finance returns 4,350 ETH to Cover Protocol treasury via on-chain transaction with embedded message (recovery — white-hat-return)
2020-12-28 (within hours) Cover Protocol revokes Blacksmith mint authority; transfers to dummy contract (defender response — circuit breaker)
2020-12-28 (within 24 hours) PeckShield publishes function-and-line-level root-cause reconstruction; Mudit Gupta publishes independent forensic analysis (forensic surface)
2020-12-29 onward Cover Protocol announces snapshot-based 1:1 migration to new COVER token contract; pre-exploit holders made whole; post-exploit-window order-book holders excluded (recovery — migration)
2021 onward ImmuneBytes auditor-side post-event analysis; Cover Protocol post-mortem published (cohort transparency)

What defenders observed

  • Pre-event (static): the Blacksmith.sol contract was open-source and on-chain-verified; the cached-pool-data pattern was visible in source. Pre-deployment review did not flag the cache-vs-storage staleness as a critical issue. Defender lesson: cache-invalidation discipline is a first-class audit checklist item for any protocol whose reward-calculation path reads pool state across a state-mutating boundary.
  • At-event (on-chain signal): totalSupply of the COVER token transitioned in a single block from ~100K to ~4×10^19 — a forty-six-order-of-magnitude divergence from the published tokenomics. Any defender or aggregator running a totalSupply reconciliation check against the published emission schedule on a per-block cadence would have flagged the exploit at block-inclusion time. Cover Protocol did not have such monitoring; the response chain was triggered by community alerting after the price collapse, not by first-party telemetry.
  • At-event (price-surface signal): COVER price fell ~97% within hours on 1inch / Uniswap — the price collapse was a downstream secondary signal but a noisy one, since DeFi tokens routinely experience large drawdowns from non-exploit causes. The primary signal is the on-chain totalSupply divergence; the price-surface is corroborating, not load-bearing.
  • Post-event: the white-hat-return outcome made the case socially distinctive in the 2020 cohort but did not change the structural defender lesson. The migration mechanism (snapshot-based 1:1 to a new contract, with order-book holders post-exploit excluded) is the canonical recovery pattern for the smart-contract-bug variant of T5.003 where a single block's mint dilution cannot be undone at the contract layer.

What this example tells contributors writing future Technique pages

  • T5.003 has at least two distinct sub-classes in mechanism even though the defender-observable effect is identical. The explicit-retained-mint-role sub-class (the canonical T1-side signal — mintAuthority on Solana SPL not renounced; ERC-20 mint callable by EOA without time-lock) and the smart-contract-platform-level-bug sub-class (cache-staleness, reentrancy-into-bookkeeping, balance-tracking errors, oracle-feeding-mint-formula) produce the same totalSupply divergence artefact, but the upstream detection surfaces differ entirely. T5.003 contributors should preserve this sub-class distinction; the Cover Protocol case anchors the smart-contract-bug sub-class at v0.1.
  • The continuous-reconciliation Mitigation generalises across both sub-classes. OAK-M02 (static-analysis pre-deployment) catches the explicit-mint-role sub-class; the equivalent Mitigation for the smart-contract-bug sub-class is continuous on-chain totalSupply reconciliation against the published emission schedule at per-block cadence. Cover is the canonical 2020 evidence that this reconciliation Mitigation is deployable and detection-latency-bounded by chain-block-time.
  • White-hat-return outcomes do not change the technique-level lesson. Contributors writing future T5.003 cases where the attacker eventually returns funds should preserve the structural artefact (totalSupply divergence) as the load-bearing technique signal; the recovery shape is downstream and orthogonal.
  • The Rari/Fei 2022-04 reentrancy-into-bookkeeping case is the cohort companion at headline scale. Contributors writing the Rari/Fei case (currently a TODO in the T5.003 citations) should cross-reference Cover as the 2020 cache-staleness antecedent. Together they bracket the smart-contract-bug variant of T5.003 across the early-DeFi cohort.

Public references

Discussion

The Cover Protocol case is OAK's canonical 2020 worked example for the smart-contract-bug-driven hidden-mint sub-class of T5.003. The case is structurally cleaner than the Rari Capital / Fei Fuse 2022-04 reentrancy-into-bookkeeping case (≈$80M, currently a TODO in the T5.003 citations) because the bug class is more isolatable — a single function's cache-vs-storage staleness rather than a multi-contract reentrancy chain through Compound v2 fork bookkeeping. Contributors writing the eventual Rari/Fei worked example should cross-reference Cover as the 2020 cache-staleness antecedent and treat the two as bracketing the smart-contract-bug variant of T5.003 across the 2020–2022 cohort.

The triangulation across PeckShield, Mudit Gupta, ImmuneBytes, Cover Protocol's own post-mortem, and Cointelegraph is structurally complete for the cohort: function-and-line-level technical reconstruction (PeckShield, Mudit), auditor-side analysis (ImmuneBytes), protocol-side first-party disclosure (Cover post-mortem), and contemporary press coverage (Cointelegraph). The case meets the v0.1 standard for "verified across at least 2 independent forensic providers" with substantial margin.

For OAK's broader cohort coverage, the Cover case + the Rari/Fei case (when written) + the SPL Token-2022 cohort (per examples/2024-2025-token-2022-transfer-hook-class-vulnerability.md and the related PD burn-on-buy cohort) collectively populate the T5.003 cohort across substrates: Cover anchors the EVM cache-staleness sub-pattern at smaller scale; Rari/Fei anchors the EVM reentrancy-into-bookkeeping sub-pattern at headline scale; the SPL Token-2022 cohort anchors the Solana explicit-mint-authority-extension sub-pattern. The cohort framing motivates the v0.x sub-Technique split into chain-and-mechanism-specific entries that the T5.003 page's Discussion section explicitly contemplates.

Techniques demonstrated (3)