Worked example · 2024-06
Velocore CPMM fee-rate underflow exploit — zkSync Era / Linea — 2024-06-02
Summary
Velocore is a CPMM (constant-product market-maker) AMM that forked from the ve(3,3) lineage popularised by Solidly / Velodrome / Aerodrome on Ethereum and Optimism, deployed on zkSync Era and Linea as the principal liquidity venue in those L2 ecosystems' early-2024 deployment cohort. On 2024-06-02 an attacker exploited an arithmetic-underflow defect in Velocore's swap-fee computation path to extract approximately $6.8M from Velocore's liquidity pools on both chains.
The proximate cause — per Velocore's own post-incident post-mortem and the corroborating PeckShield, BlockSec, and SlowMist forensic write-ups — is a fee-rate computation in the CPMM swap path that, under specific input conditions, produced an underflowing intermediate value. The underflow turned the computed fee rate from a small positive number into a very large positive number when interpreted as an unsigned value, with the further consequence that the fee-application logic effectively credited the swapper (the pool paid out additional tokens corresponding to the misinterpreted "fee") rather than charging the swapper. By constructing swap inputs that triggered the underflow, an attacker could extract pool reserves with each crafted swap; flash-loaned working capital scaled the per-swap extraction into a multi-million-dollar single-window drain.
Velocore's affected contracts were paused; the protocol's subsequent post-mortem identified the specific fee-computation function and the underflow-trigger input range, and the fork-line patch was deployed to non-affected pools and forks. Linea's operator team — at that point still operating the L2 with a centralised sequencer — publicly acknowledged a temporary block-production halt as a defensive response, which constrained the attacker's ability to bridge proceeds off Linea in the immediate post-extraction window. The proceeds were nevertheless subsequently bridged to Ethereum and laundered through Tornado Cash; the Linea pause was a delay rather than a recovery primitive.
For OAK's purposes the case is a clean T9.005 (arithmetic-underflow sub-class) extraction with a T9.002 (flash-loan) working-capital precondition. The novel OAK contribution of the worked example is the fork-line-on-novel-L2 compounded audit-coverage surface — the structural property that fork-line protocols deploying on novel L2s inherit both the fork-line's audit-coverage gaps and the novel L2's tooling-and-monitoring thinness, and that the compounded surface produces incident shapes that pure-EVM-mainnet defender practice does not anticipate.
Timeline (UTC)
| When | Event | OAK ref |
|---|---|---|
| Pre-event | Velocore deploys ve(3,3)-style CPMM forks on zkSync Era and Linea; fee-computation function in swap path inherits an arithmetic-correctness defect from the fork-line under specific input conditions; defect latent across deployed pools | T9.005 surface (latent) |
| Pre-event | Attacker funds wallet via Tornado Cash; analyses Velocore deployment on both chains; identifies the underflow-trigger input range in the fee-computation path | (off-OAK pre-event observation) |
| 2024-06-02 (attack-tx window) | Attacker opens flash loan; constructs crafted swaps against Velocore wstETH-based pools on zkSync Era and paired pools on Linea; underflow in fee-computation produces effective negative-fee swap output; attacker extracts pool reserves; repeats across pools; cumulative extraction ~$6.8M | T9.005 + T9.002 extraction |
| 2024-06-02 (within attack window) | Velocore on-call response detects anomalous outflows; pauses affected contracts on both chains | (operator response) |
| 2024-06-02 (within attack window) | Linea operator team publicly acknowledges a temporary sequencer-pause / block-production halt as a defensive response; bridge outflows from Linea constrained in the immediate post-extraction window | (chain-operator defensive response) |
| 2024-06-02 onward | Velocore publishes initial public acknowledgement; post-incident technical post-mortem follows | (operator-side public-acknowledgement) |
| 2024-06-02 onward | PeckShield, BlockSec, SlowMist publish forensic write-ups converging on the fee-computation-underflow root cause | (transparency / cohort signal) |
| Days following | Proceeds bridged to Ethereum once Linea sequencer resumes; laundered through Tornado Cash | T7.001 (off this example's framing) |
| 2024-06 onward | Velocore deploys fork-line patch; affected pools restored or migrated; cohort write-ups document the defect for the broader ve(3,3)-fork-line population | (cohort patch deployment) |
| Continuing | No public on-chain recovery; no civil-forfeiture action | (recovery state) |
What defenders observed
- The defect was an arithmetic-correctness bug in the fee-computation path, not a reentrancy. Velocore's swap-fee logic, under specific input conditions related to the swap-amount-to-pool-balance ratio, computed an intermediate value that underflowed in unsigned arithmetic. The underflow turned a small positive fee rate into a very large positive value that, when applied to the swap, effectively reversed the fee direction — the pool paid the swapper rather than charging the swapper. This is sub-class arithmetic-correctness, structurally akin to the Onyx empty-market rounding-error case at
/examples/2024-09-onyx.mdrather than to a reentrancy in the canonical 2016 sense. Defender threat models for AMM-fork-line protocols should treat arithmetic-correctness across fee-computation and share-price-computation paths as a first-class audit checklist item. - Fork-line audit history does not transfer cleanly to fork-line forks under modified parametrisations. The ve(3,3) fork lineage (Solidly / Velodrome / Aerodrome / etc.) had been audited and battle-tested in its EVM-mainnet and Optimism-mainnet deployments. Velocore's fork applied modifications to the fee-computation path under deployment-specific parametrisations on zkSync Era and Linea; the upstream's audit history did not cover those modifications under the specific input ranges that triggered the underflow. The Mitigations-layer lesson is that fork-line audit-history transfer is not automatic; any fork-line protocol making non-trivial modifications to the upstream — particularly to arithmetic-correctness-sensitive paths — should re-audit the modified path under the deployed parametrisation, and should not rely on upstream audit history as evidence of correctness for the modified surface.
- Novel-L2 deployment context compounds fork-line audit-coverage thinness. zkSync Era and Linea were both, in mid-2024, relatively novel L2s whose audit-and-monitoring tooling ecosystems were thinner than the EVM-mainnet equivalents. The Velocore incident was one of several 2024 zkSync-Era exploits — the broader cluster also includes Era Lend and other incidents — that share the structural property of fork-line protocols deploying on novel L2s and inheriting the compounded audit-and-monitoring gap. Defender practice for novel-L2 deployment cohorts should expect a higher-than-EVM-mainnet incident rate during the early-deployment-cohort window and should provision proportionately heavier per-protocol audit coverage during that window.
- Linea's sequencer-pause was a delay, not a recovery primitive. Linea operator team publicly acknowledged a temporary block-production halt during the immediate post-extraction window. The pause prevented the attacker from bridging Linea-side proceeds off the chain in real time, but did not produce on-chain reversal of the executed extraction. Once Linea resumed sequencer operations, the proceeds were bridgeable. The Mitigations-layer dimension is that L2-sequencer-pause is a different recovery primitive from L1-validator-coordinated-freeze (Cetus 2025) and from on-contract-centralised-authority recovery (Gala 2024 at
/examples/2024-05-gala-games.md); the L2-sequencer-pause primitive can buy time, but the time it buys is operator-acceptable only if a more substantive recovery primitive is available within the bought window — which at Velocore was not the case. - The pseudonymous attribution status is the realistic attribution outcome for this class. Funding was routed through Tornado Cash pre-event; laundering routed through Tornado Cash post-event; no industry forensics provider has converted on-chain analysis into a named-individual claim. There is no public OAK-G01 attribution. Contributors should not over-claim attribution simply because the on-chain forensics are detailed.
What this example tells contributors writing future Technique pages
- T9.005 covers arithmetic-underflow as a sub-class within its broader arithmetic-correctness construction. The Velocore 2024 case is the canonical 2024 worked example for the underflow sub-class on AMM swap-fee computation paths. Together with Onyx 2024 at
/examples/2024-09-onyx.md(rounding-error sub-class on Compound v2 fork share-price computation paths), the two cases anchor the arithmetic-correctness construction of T9.005 in the 2024 cohort. Future contributor guidance may consider promoting arithmetic-correctness to its own technique ID; until then, the broad construction holds and worked examples should preserve sub-class detail. - T9.002 is the precondition that scales per-bug-unit profits to useful magnitudes. The Velocore case follows the same precondition / extraction structure as Onyx 2024, Penpie 2024 at
/examples/2024-09-penpie.md, Beanstalk 2022, and bZx 2020 — flash-loaned working capital converts a per-swap or per-call rounding/underflow/oracle-skew profit into a multi-million-dollar single-transaction extraction. Worked examples should preserve the precondition / extraction distinction. - Fork-line + novel-L2 is a compounded audit-coverage surface that the Mitigations layer should cover explicitly. The Velocore case is the clearest 2024 worked example. Defenders looking at the fork-line dimension alone (e.g., is this protocol a known-fork-line of an audited upstream) miss the novel-L2 dimension (is the deployment context one with mature tooling), and vice versa. Both dimensions matter and they compound. Future contributor guidance should consider a cross-cutting Mitigation entry covering fork-line audit-history transfer under modified parametrisations, with Velocore 2024 and the broader 2024 zkSync-Era exploit cluster as the primary worked examples.
- L2-sequencer-pause is a discrete recovery-primitive sub-class within OAK's Recovery-Primitives taxonomy. The Velocore case is the canonical 2024 worked example for the bounded-delay L2-sequencer-pause sub-class — a primitive that constrains the attacker's bridge-out window without producing on-chain reversal. This is operationally distinct from L1-validator-coordinated-freeze (which can produce reversal on permissioned-validator-set L1s such as Sui in the Cetus 2025 case), from in-mempool MEV-searcher-rescue (Ronin 2024 at
/examples/2024-08-ronin-bridge-rescue.md), from on-contract-centralised-authority (Gala 2024 at/examples/2024-05-gala-games.md), and from post-extraction recovery-negotiation (Euler 2023). Contributors writing the Mitigations-layer Recovery-Primitives entry should record L2-sequencer-pause as a separate primitive with the Velocore 2024 case as its anchor. - Pseudonymous attribution is the realistic outcome and should not be over-claimed. OAK status
pseudonymousis correct; contributors writing the worked-example layer should not over-claim attribution simply because on-chain forensics are detailed.
Public references
[velocorepostmortem2024]— Velocore official post-incident post-mortem identifying the fee-computation underflow root cause and the affected pools.[peckshieldvelocore2024]— PeckShield headline figures and on-chain analytics for the Velocore June 2024 drain.[blocksecvelocore2024]— BlockSec / on-chain forensic analysis of the Velocore swap-trace exposing the underflow-favourable computation.[slowmistvelocore2024]— SlowMist incident analysis covering funding-source tracking and Tornado Cash laundering pattern.[lineavelocore2024]— Linea / ConsenSys public statement on the temporary sequencer-pause defensive response during the Velocore incident window.[rektvelocore2024]— Rekt News public-facing summary framing the case as a fee-rate-underflow CPMM exploit on zkSync Era and Linea.[halbornvelocore2024]— Halborn post-incident technical write-up of the Velocore exploit including the fee-computation function-level analysis.
Discussion
Velocore 2024 is OAK's canonical case for the arithmetic-underflow sub-class of T9.005 in the AMM swap-fee-computation context, paired with the fork-line-on-novel-L2 compounded audit-coverage surface as the structural framing. The two together produce a worked example that is operationally instructive in two distinct dimensions and should be cross-referenced from both the T9.005 technique page and any Mitigations-layer entry on fork-line audit-coverage and novel-L2-deployment-context.
The arithmetic-underflow dimension generalises beyond Velocore. AMM swap-fee logic, share-price computation, lending-market interest-rate computation, and similar computational paths in DeFi protocols routinely involve unsigned-integer arithmetic over values that, under specific input conditions, can underflow or overflow in ways that the surface-level computation does not anticipate. The Onyx empty-market rounding-error case at /examples/2024-09-onyx.md is the same broad arithmetic-correctness construction in a different sub-class and a different protocol context (Compound v2 fork share-price computation rather than CPMM fee-rate computation); together with Velocore, the two cases anchor the 2024 arithmetic-correctness sub-class within T9.005. A future v0.x update may warrant promoting arithmetic-correctness to its own technique ID, with the underflow / overflow / rounding-error / precision-loss sub-classes as distinct subtypes; until that promotion happens, T9.005's broad construction continues to hold and worked examples should preserve sub-class detail in their text.
The fork-line-on-novel-L2 compounded surface is the corpus-level framing point. Velocore is a ve(3,3) fork — a known fork-line with a substantial audit-and-deployment history on EVM-mainnet and Optimism. Velocore's deployment context — zkSync Era and Linea in mid-2024 — was a novel-L2 cohort whose audit-and-monitoring tooling was, at the time, thinner than the EVM-mainnet equivalents. The compounded surface is that fork-line audit-history transfer is not automatic across modified parametrisations and novel-L2-deployment-context produces incident shapes that EVM-mainnet defender practice does not anticipate. Both dimensions matter; both compound; and the Velocore case is the clearest 2024 worked example. The broader 2024 zkSync-Era exploit cluster — which also includes Era Lend and other incidents — strengthens the cohort signal and should be cross-referenced where novel-L2-deployment-context is relevant.
For OAK's broader credibility, including Velocore 2024 in v0.1 closes two gaps: it adds a 2024 worked example of the arithmetic-underflow sub-class of T9.005 in the AMM-fee-computation context that complements the Onyx rounding-error sub-class in the lending-protocol context, and it documents the fork-line-on-novel-L2 compounded audit-coverage surface as a structural dimension that the Mitigations layer should cover explicitly rather than implicitly.