OAK — OnChain Attack Knowledge

Worked example · 2025-12

USPD CPIMP "Clandestine Proxy In the Middle of Proxy" stablecoin exploit — Ethereum — admin-frontrun 2025-09-16; mint event 2025-12

Loss
approximately $1M direct on-chain extraction in the December 2025 mint-and-drain event. The attacker performed an unauthorised mint of approximately 98M USPD stablecoin tokens in a single transaction, then used the minted USPD as collateral to drain approximately 232 stETH (~$1M at then-prevailing prices) from the protocol's stETH-backed reserves. Aggregate loss is bounded by the protocol's stETH reserves at the moment of execution; broader market-cap dilution of the legitimate USPD float is the structurally distinct secondary loss surface, addressed by the USPD team's relaunch + 1:1 legitimate-holder-redemption plan.
OAK Techniques observed
OAK-T6.001 (Source-Verification Mismatch) — the canonical instantiation at v0.1: the attacker's malicious proxy implementation forwarded all calls to USPD's audited contract code, while combination of event payload manipulation + storage slot spoofing deceived Etherscan into displaying the legitimate audited contract as the implementation. The result was that the verified-source surface (Etherscan, the load-bearing public-record verification artefact for an Ethereum stablecoin contract) showed the correct audited code while the live execution path routed through the attacker's backdoored shadow proxy. The bytecode-source mismatch is exactly T6.001's failure mode but achieved via a more sophisticated mechanism than naive verification claim — the attacker engineered the on-chain artefacts that drive Etherscan's display logic to match the audited code while the runtime authority structure pointed elsewhere. OAK-T6.005 (Proxy-Upgrade Malicious Switching) — chains as the upgrade-authority leg: the attacker held administrative privileges over the proxy from 2025-09-16 through the 2025-12 execution date and used those privileges to upgrade the proxy implementation to extraction-enabling logic at the moment of attack. OAK-T9.004 (Access-Control Misconfiguration) at the frontrunning entry vector: the deployment script's initialization sequence permitted a Multicall3-bundled frontrun that seized administrative privileges before the legitimate deployer's initialization transaction landed. OAK-T5.003 (Hidden-Mint Dilution — the attacker used the seized administrative privileges to mint approximately 98M USPD stablecoin tokens in a single transaction from nothing, creating a counterfeit-issuance flow against the protocol's claimed token-supply contract; the minted USPD was then used as collateral to drain the stETH reserves) + OAK-T9.009 (Cross-Contract Reinitialization Attack).
Attribution
inferred-strong at the technical-mechanism layer per Halborn's December 2025 forensic write-up + USPD's own technical post-mortem (which named the attack vector "CPIMP — Clandestine Proxy In the Middle of Proxy"). Multiple independent outlets (Cryptopolitan, crypto.news, Cryptonomist, Cryptotimes, Tronweekly, Bitget News, MEXC News) published convergent reporting. The attacker / operator identity is not publicly named at v0.1 cutoff; pseudonymous at the per-incident attribution layer. USPD offered a 10% whitehat-return bounty after disclosure; whitehat-return status is not publicly resolved at v0.1.
OAK-Gnn
unattributed at v0.1; the case is a candidate seed for a future operator-cluster OAK-G entry covering the 2025 cohort of frontrun-deployment-initialization attacks (the broader category includes deployer-initialization-frontrun cases on Layer-2 launches and on cross-chain-bridge deployments throughout 2025; USPD is the cleanest stablecoin-class anchor at v0.1).
Key teaching point
USPD is the canonical December-2025 worked example for CPIMP — Clandestine Proxy In the Middle of Proxy — a discrete advanced-evasion sub-class of T6.001 + T6.005 in which the attacker (a) seizes admin authority over a proxy via deploy-time initialization frontrun, (b) deploys a shadow implementation that forwards all calls to the audited / legitimate code, and (c) uses event-payload-manipulation + storage-slot-spoofing to cause block-explorer-side verification (Etherscan) to display the audited code as the proxy implementation while runtime calls route through the shadow.

Summary

USPD ("US Permissionless Dollar") is a decentralized stablecoin protocol on Ethereum with a stETH-backed mint flow. The protocol was deployed in September 2025; the deployment process used a multi-step initialization sequence (deploy proxy → set implementation → initialize admin roles → set parameters) that the legitimate deployer was executing as a sequence of transactions.

On 2025-09-16, an attacker monitoring the deployment process executed a Multicall3-bundled transaction that frontran the deployer's initialization sequence — the attacker's transaction was included in a block before the legitimate deployer's initialize call landed. The Multicall3 bundle assigned administrative privileges (the role with proxy-upgrade authority) to the attacker's address before the deployer's intended initialization could complete. The deployer's subsequent initialization transaction either reverted, completed against an already-consumed initialization-state guard, or completed but wrote to fields that the attacker's prior bundle had already locked.

The attacker, holding administrative authority over the proxy, deployed a "shadow" implementation contract that forwarded all calls to USPD's audited and intended-legitimate code. Externally — to users, to auditors, and to Etherscan — the proxy's behaviour appeared identical to the audited specification. The attacker's shadow implementation, however, embedded two specific defense-evasion overlays:

  • Event payload manipulation — the shadow implementation emitted events whose payloads were crafted to match what an Etherscan indexer would expect from the legitimate audited contract, including events that drive Etherscan's "Implementation" display field on the proxy's contract page.
  • Storage slot spoofing — the shadow implementation manipulated the EIP-1967 implementation-slot value (or analogous slot used by the proxy pattern in question) so that read-only queries against the proxy returned the legitimate audited contract's address, even though the live execution path routed through the attacker's backdoored shadow.

Combined, these two overlays caused Etherscan to display the legitimate audited contract code as the proxy's implementation, while runtime calls executed through the attacker's shadow. The shadow remained operational from September 2025 through December 2025 — approximately three months — without detection by users, auditors, or block-explorer-side verification tooling.

In December 2025, the attacker upgraded the proxy implementation from the shadow (which forwarded calls to the audited code) to a separate extraction-enabling implementation. The new implementation permitted an unauthorised mint of approximately 98M USPD in a single transaction; the attacker then used the minted USPD as collateral input in the protocol's stETH-redemption flow to drain approximately 232 stETH (~$1M) from the protocol's reserves. After execution, the attacker abandoned the proxy.

Halborn published a full technical write-up in December 2025 ("Explained: The USPD Hack") characterising the attack vector as "CPIMP — Clandestine Proxy In the Middle of Proxy" — terminology adopted from USPD's own post-mortem. USPD launched an investigation, offered a 10% whitehat-return bounty, and announced a relaunch + 1:1 legitimate-holder-redemption plan.

For OAK's T6 framing, USPD is the canonical December-2025 worked example demonstrating three load-bearing structural features:

  1. The verification surface itself was the attack target. Standard T6.001 cases involve the attacker simply not verifying (or verifying a misleading source). USPD demonstrates the more sophisticated case where the attacker actively engineers the on-chain artefacts that drive Etherscan's display logic to match the audited code, while the runtime authority structure differs. The attacker is not bypassing verification; the attacker is causing verification to display the legitimate code by construction. This is a discrete advanced-evasion sub-class of T6.001 that warrants explicit naming in v0.x updates.

  2. The deployment-initialization frontrun is the entry vector. The attacker did not exploit a code-level bug or a key compromise; the attacker exploited a deployment-process timing gap in the multi-step initialization sequence. This is structurally adjacent to but distinct from standard access-control misconfiguration (T9.004) and standard proxy-upgrade abuse (T6.005); the underlying gap is in the deploy-time process design, not in the deployed code. The defender-side Mitigation surface is at the deploy-process layer (atomic-initialization-bundle, deploy-via-Create2-with-salt-tied-to-init-payload, or two-phase deploy with on-chain-attested initial-deployer-only window) rather than at the runtime-code layer.

  3. The dwell-time was three months. The shadow implementation was operational from September 2025 through December 2025 without detection. This dwell-time bounds the calibrated detection cadence — block-explorer-side verification systems (Etherscan, Sourcify, Blockscout) and protocol-side monitoring (custody-balance reconciliation, mint-event audit) have a multi-month gap during which a sophisticated CPIMP-class adversary can hold administrative authority while presenting a fully-legitimate verification surface. Halborn's analysis identifies the dwell-time as the structurally most concerning feature of the case for the broader proxy-pattern ecosystem.

Timeline (UTC)

When Event OAK ref
Pre-2025-09-16 USPD deployer prepares multi-step deployment sequence: deploy proxy → set implementation → initialize admin roles → set parameters; sequence is executed as separate transactions on Ethereum mainnet (deployment-process precondition)
2025-09-16 Attacker monitors mempool / pending transactions; identifies the deployment sequence in flight; constructs a Multicall3-bundled frontrun transaction that seizes admin role assignment ahead of the deployer's initialization T9.004 entry vector (deployment-init frontrun)
2025-09-16 Attacker's Multicall3 bundle lands; attacker holds admin / proxy-upgrade authority over USPD's proxy; deployer's subsequent initialization transaction either reverts or completes against pre-consumed state (admin-authority hijack)
2025-09-16 to 2025-12 (dwell window) Attacker deploys shadow implementation that forwards calls to the audited implementation; uses event payload manipulation + storage slot spoofing to cause Etherscan to display the legitimate audited contract as the proxy implementation T6.001 + T6.005 (CPIMP shadow)
2025-09-16 to 2025-12 Protocol operates normally to external observers; users and auditors see the audited code on Etherscan; runtime calls route through the attacker's shadow but the shadow forwards them faithfully to the audited code (operational dwell)
2025-12 Attacker upgrades proxy implementation from shadow to extraction-enabling implementation; executes unauthorised mint of 98M USPD in single transaction T6.005 (malicious upgrade) + T1 (counterfeit issuance)
2025-12 Attacker uses minted USPD as collateral input to protocol's stETH-redemption flow; drains 232 stETH ($1M) from reserves T9.004 / T5 (extraction)
2025-12 USPD detects the unauthorised mint and the stETH outflow; pauses affected functions; investigates (operator response)
2025-12 (within days) Halborn publishes "Explained: The USPD Hack" technical write-up; USPD publishes own post-mortem coining "CPIMP — Clandestine Proxy In the Middle of Proxy" terminology (forensic publication)
2025-12 onward USPD offers 10% whitehat-return bounty; announces relaunch + 1:1 legitimate-holder-redemption plan (operator response — recovery surface)
Continuing Whitehat-return status not publicly resolved at v0.1 cutoff; attacker / operator identity not publicly named; USPD relaunch trajectory ongoing (attribution state)

What defenders observed

  • Etherscan-verified-source claims do not bind runtime authority structure when the proxy pattern is in use. USPD's proxy displayed the legitimate audited implementation on Etherscan throughout the September-to-December dwell window. The verification claim was structurally true at the display layer (Etherscan's indexer was reading the on-chain artefacts the attacker had crafted to match the legitimate code) and structurally false at the authority layer (runtime calls routed through the attacker's shadow). The defender lesson is that proxy-pattern contracts require runtime authority verification in addition to source verification — read the EIP-1967 implementation slot value at runtime against the displayed-implementation address, and verify both match the expected audited address. Standard Etherscan reads alone are not sufficient.
  • Deployment-initialization frontruns are the entry-vector class for CPIMP. The structural gap is in the multi-step deployment sequence — between proxy deployment and initialization, the proxy's admin role is assignable by anyone who calls initialize first. The Mitigation operates at the deploy-process layer: deploy proxy + set implementation + initialize-with-admin-role in a single atomic bundle (e.g., via constructor-based initialization, Create2 with salt-tied-to-init-payload, or factory-based deploy that completes initialization in the same transaction as deploy).
  • Halborn's CPIMP analysis is the canonical defender-side anchor for this attack class. Halborn's December 2025 technical write-up is the cleanest worked-example walkthrough of the event-payload-manipulation + storage-slot-spoofing combination. The case is now the load-bearing public-record reference for verification-surface attacks; future v0.x worked examples of analogous attacks should cross-reference Halborn's analysis as the methodology anchor.
  • Three-month dwell time bounds calibrated detection cadence. The shadow operated for approximately 90 days without detection by users, auditors, or block-explorer-side verification tooling. This is a calibrated upper-bound for how long a CPIMP-class adversary can hold administrative authority while presenting a legitimate verification surface. Block-explorer-side detection cadences (Etherscan re-verification, Sourcify continuous-verification) and protocol-side custody-balance-reconciliation cadences should be tuned with this dwell-time as the calibration anchor.
  • Custody-balance reconciliation against expected mint-supply is the protocol-side detection requirement. USPD's reserves should at all times match the legitimate-issuance accounting; the December unauthorised mint of 98M USPD broke reconciliation immediately. Protocol-side monitoring that reconciles total-supply-issued against reserves-backed at calibrated cadences (e.g., minute-scale for stablecoins, block-scale for AMM LPs) is the load-bearing detection requirement; the case is the cleanest 2025 worked example of a multi-month dwell that would have been caught at execution-time by reconciliation but was not caught during dwell by any standard tool.

What this example tells contributors writing future Technique pages

  • CPIMP is a discrete advanced-evasion sub-class of T6.001 + T6.005. The combination of (a) deploy-time admin frontrun, (b) shadow proxy that forwards to audited code, and (c) event-payload-manipulation + storage-slot-spoofing to deceive Etherscan, defines a discrete attack class that warrants explicit naming in v0.x updates. The detection-signal layer (runtime-authority-verification at the EIP-1967 slot level) is materially different from headline T6.001 (deterministic-recompile against verified source) and warrants its own Mitigation enumeration.
  • Deploy-process-layer Mitigations are a discrete mitigation surface beyond runtime-code mitigations. The CPIMP entry vector is at the deploy-process layer — the gap between proxy deployment and initialization. Future T6 / T9.004 Mitigation guidance should enumerate atomic-initialization-bundle patterns (constructor-based init, factory-based deploy-and-init, Create2-with-salt-tied-to-init-payload) as the load-bearing deploy-process-layer Mitigation. The runtime-code layer (e.g., initializer modifier) is necessary but not sufficient against the frontrun pattern.
  • Block-explorer-side verification cannot be assumed to bind runtime authority structure. Etherscan's verification surface is the load-bearing public-record artefact for Ethereum contracts; the CPIMP case demonstrates that an attacker can engineer the on-chain artefacts that drive Etherscan's display to match the audited code while the runtime authority points elsewhere. Future T6.001 worked examples should preserve this distinction; verification claims must be paired with runtime-authority-verification (EIP-1967 slot reads + admin-role-holder reads) to bind the chain of trust end-to-end.
  • Dwell-time is a load-bearing structural feature of CPIMP-class incidents. Future worked examples in this category should record the dwell window — the time from the entry-vector event (deploy-time admin frontrun) to the extraction event (mint / drain) — as a load-bearing structural feature. Dwell-time bounds the calibrated detection cadence and informs the protocol-side monitoring guidance for future deployments. USPD's three-month dwell is the v0.1 calibration anchor.

Public references

Discussion

USPD is the canonical December-2025 worked example for CPIMP — Clandestine Proxy In the Middle of Proxy — a discrete advanced-evasion sub-class of T6.001 + T6.005 in which the attacker (a) seizes admin authority over a proxy via deploy-time initialization frontrun, (b) deploys a shadow implementation that forwards all calls to the audited / legitimate code, and (c) uses event-payload-manipulation + storage-slot-spoofing to cause block-explorer-side verification (Etherscan) to display the audited code as the proxy implementation while runtime calls route through the shadow.

The case is structurally significant for OAK's T6 coverage along three load-bearing axes:

  1. The verification surface itself is the attack target, not bypassed. Standard T6.001 cases involve the attacker not verifying or verifying a misleading source. USPD demonstrates the more sophisticated case where the attacker actively engineers the on-chain artefacts that drive Etherscan's display to match the audited code by construction. This is a discrete advanced-evasion sub-class that warrants explicit T6.001.NN sub-Technique enumeration in v0.x updates. The detection-signal layer is materially different — runtime-authority-verification at the EIP-1967 slot level, paired with admin-role-holder enumeration, rather than deterministic-recompile against verified source.

  2. The entry vector is at the deploy-process layer, not the runtime-code layer. The CPIMP attack does not exploit a Solidity bug, a compiler bug, or a key compromise; it exploits a timing gap in the multi-step deployment sequence. The Mitigation surface is therefore at the deploy-process design layer (atomic-initialization-bundle, Create2-with-salt-tied-to-init-payload, factory-based deploy-and-init). Standard runtime-code Mitigations (e.g., OpenZeppelin's Initializable modifier, single-use-init guards) are necessary but not sufficient against the deployment-frontrun entry vector.

  3. Three-month dwell-time bounds calibrated detection cadence. The shadow operated for approximately 90 days without detection. Block-explorer-side verification cadences and protocol-side custody-reconciliation cadences should be tuned with this dwell-time as the v0.1 calibration anchor. Custody-balance reconciliation against expected mint-supply at minute-scale (for stablecoins) or block-scale (for AMM LPs) is the load-bearing protocol-side detection requirement; the case demonstrates that runtime detection at the execution moment was effective, but no detection caught the dwell window.

For OAK's broader cohort coverage, USPD anchors T6.001 at named-incident, named-date scale for 2025. The case complements examples/2025-02-bybit.md (malicious-implementation-replacement at multisig-Safe layer; T11.003 / T9.004 primary) by anchoring the non-multisig / standard-EOA-deploy CPIMP variant. The two cases together establish that proxy-pattern admin-authority compromise is a multi-form attack class in 2025: signed-multisig-replacement on the Bybit / Lazarus end of the spectrum, and deploy-init-frontrun-shadow-proxy on the USPD / pseudonymous end.

Halborn's CPIMP analysis is the canonical defender-side public-record reference; future T6.001 / T6.005 worked examples in this category should cross-reference the methodology anchor. The NDSS 2024 academic paper "Abusing the Ethereum Smart Contract Verification Services for Fun and Profit" provides the academic prior-art context — the verification-surface attack class was demonstrated as feasible at the academic-research level through 2023-2024; USPD is the load-bearing public-record incident in 2025 that demonstrates the operational deployment of the class against a stablecoin protocol with material custody under management.

Techniques demonstrated (5)