OAK — OnChain Attack Knowledge

Worked example · 2022-03

Agave / Hundred Finance reentrancy exploit — Gnosis Chain — 2022-03-15

Loss
approximately $5M across wrapped ETH, USDC, GNO, and LINK, drained from Agave's Compound-v2-forked lending market on Gnosis Chain. The same attacker exploited Hundred Finance on Gnosis Chain the same day using a structurally identical reentrancy path.
OAK Techniques observed
OAK-T9.005 (Reentrancy — primary; the attacker used a reentrancy vulnerability in Agave's lending-market logic, exploiting the ERC-677 onTokenTransfer callback to re-enter the borrow function before the collateral state update completed). OAK-T1.007 (Token-2022 Transfer-Hook Abuse — cross-standard analogue via the ERC-677 callback, which is Gnosis Chain's native token callback mechanism, structurally parallel to ERC-777 and the Token-2022 transfer-hook pattern).
Attribution
unattributed pseudonymous; the attacker has not been publicly identified. No portion of the funds was returned.
Key teaching point
A lending-market fork of Compound V2 that deploys on a chain with native token callbacks (Gnosis Chain's ERC-677 onTokenTransfer, analogous to ERC-777 hooks) inherits a reentrancy surface that the original Compound V2 deployment on Ethereum (where standard ERC-20 tokens have no transfer callback) did not have. The fork inherit-and-deploy pattern without chain-specific reentrancy audit is the load-bearing pre-incident anti-pattern.

Summary

Agave was a Gnosis Chain (formerly xDai Chain) lending protocol that forked Compound V2. On 2022-03-15, an attacker exploited a reentrancy vulnerability in Agave's lending-market contract logic, triggered through Gnosis Chain's native ERC-677 token standard. ERC-677 tokens on Gnosis Chain include an onTokenTransfer callback that notifies the recipient contract when tokens are transferred to it — structurally analogous to the ERC-777 tokensReceived hook and the Solana Token-2022 transfer-hook extension. The Compound V2 codebase was designed for standard ERC-20 tokens that do not invoke a recipient callback on transfer, so the original lending-market logic did not guard against reentrancy through the transfer path.

The attacker:

  1. Deposited collateral into the Agave lending market.
  2. Borrowed against the collateral, triggering a token transfer to the attacker's contract.
  3. The ERC-677 onTokenTransfer callback in the attacker's contract fired during the token transfer, before Agave's collateral-state update completed.
  4. The attacker re-entered the borrow function from within the callback, borrowing again against the same collateral before the initial borrow was recorded.
  5. The attacker repeated the reentrancy cycle across multiple borrow operations, extracting approximately $5M in wrapped ETH, USDC, GNO, and LINK.

The same attacker exploited Hundred Finance on Gnosis Chain the same day using a structurally identical reentrancy path through the ERC-677 callback, confirming the chain-specific callback mechanism as the load-bearing vulnerability surface rather than an Agave-specific coding error.

Timeline (UTC)

When Event OAK ref
2022-03-15 Attacker deposits collateral into Agave lending market on Gnosis Chain (setup)
2022-03-15 (same block) Attacker initiates borrow, triggering ERC-677 onTokenTransfer callback during token transfer T9.005 (reentrancy trigger)
2022-03-15 (same block) Attacker re-enters borrow function from within the onTokenTransfer callback before collateral-state update; borrows against same collateral repeatedly T9.005 (reentrancy extraction)
2022-03-15 (same block) Attacker extracts ~$5M in wETH, USDC, GNO, LINK across multiple reentrancy cycles T9.005 (extraction complete)
2022-03-15 (same day) Attacker exploits Hundred Finance on Gnosis Chain using the structurally identical ERC-677 reentrancy path T9.005 (second victim, same Technique)
2022-03-15 (post-event) Agave and Hundred Finance teams identify the exploit; publish post-mortems (operator response)

Public references

  • Agave operator-side post-mortem, March 2022 — [agavepostmortem2022].
  • Hundred Finance operator-side post-mortem, March 2022 — [hundredfinancepostmortem2022].
  • SlowMist forensic analysis of the ERC-677 reentrancy — [slowmistagave2022].
  • PeckShield on-chain trace — [peckshieldagave2022].
  • Rekt News public-facing summary — [rektagave2022].
  • ERC-677 token standard specification — [erc677spec].
  • Cross-reference: T9.005 (Reentrancy) at techniques/T9.005-reentrancy.md.
  • Cross-reference: T1.007 (Token-2022 Transfer-Hook Abuse) at techniques/T1.007-token-2022-transfer-hook-abuse.md.

Discussion

Agave is the canonical worked example for the chain-specific-token-callback reentrancy surface: a protocol forked from a codebase designed for standard ERC-20 (no transfer callback) inherits a reentrancy vulnerability when deployed on a chain whose native token standard (Gnosis Chain's ERC-677) includes a recipient callback. The OAK classification is cross-standard: T9.005 (Reentrancy) is the primary classification because the extraction mechanism is reentrancy, but T1.007 (Token-2022 Transfer-Hook Abuse) is a structurally correct cross-classification because the ERC-677 onTokenTransfer callback is functionally analogous to the Solana Token-2022 transfer-hook pattern that T1.007 was originally designed to describe. The cross-standard framing is deliberate: the same vulnerability shape (transfer-triggered callback enabling reentrancy in lending-market logic) can recur across any token standard that includes a recipient-notification mechanism, and tracking the cross-standard incidence is a load-bearing contribution to defender-portfolio coverage.

The paired Agave-and-Hundred-Finance same-day exploit confirms that the ERC-677 callback mechanism is the load-bearing surface, not an isolated code-level error in a single protocol. Two independent lending-market forks of Compound V2, exploited the same day by the same attacker using the same reentrancy path, establish the chain-level callback standard as a systematic attack surface for Compound-V2 forks on Gnosis Chain specifically.

Techniques demonstrated (2)