Uniswap V4 Hook Vulnerability Triggers Major Security Breach

The DeFi ecosystem faces another security setback. A targeted attack on an Ethereum user's Safe wallet resulted in the loss of rsETH tokens valued at approximately $7.73 million. The incident highlights sophisticated new risks emerging from advanced protocol features.

Anatomy of the Attack: From Module Diversion to Asset Unwrapping

The attack did not compromise private keys. Instead, the assailant manipulated the victim's custom Uniswap V4 Liquidity Provider module. By using a publicly accessible "Keeper Multicall" function, the attacker redirected the module's connection to a maliciously crafted HookPool under their control.

Once the connection was established, the malicious Hook executed its payload. Its primary action was to unwrap the aEthrsETH token into its base rsETH form. While unwrapping is a standard DeFi operation, in this context it served as the critical step to make the assets movable.

Instantaneous Asset Extraction

The final phase demonstrated the lightning-fast nature of blockchain transactions. The newly unwrapped rsETH was not left in the victim's wallet. Within the same Ethereum block, a MEV bot identified as "Yoink" swiftly extracted and transferred the funds away.

This attack pattern underscores a dangerous confluence of risks:

  • Abuse of Protocol Features: Public on-chain tools designed for maintenance were weaponized as an attack vector.
  • Hook Mechanism Perils: The high customizability of Uniswap V4 Hooks, while powerful, expands the attack surface for malicious code.
  • The Dark Side of MEV： Maximum Extractable Value bots, which can enhance network efficiency, can also be leveraged for instant fund laundering, complicating recovery efforts.

Security teams have confirmed the attack, though the perpetrator's identity and the full trail of the stolen funds remain under investigation. For DeFi users, this serves as a stark reminder to exercise extreme caution when granting permissions or connecting modules to highly customizable, cutting-edge protocols.