## Cork Protocol Exploit (May 2025)

### 1. What happened

On 28 May 2025 at 11:39 UTC, an attacker drained 3,761 wstETH (approximately $11.9 million at the time, reported as $12 million by rekt.news) from Cork Protocol's wstETH:weETH Liquidity Vault on Ethereum mainnet. The funds were converted to ETH via 1inch and held at the attacker's address. No other Cork markets were affected; roughly $20 million in other vaults was paused and later returned to users.

- Cork's post-mortem: https://www.cork.tech/blog/post-mortem
- rekt.news: https://rekt.news/cork-protocol-rekt
- wstETH price at exploit time from DeFiLlama historical API: $3,162.92 (timestamp 1748429935), yielding $11,895,742 for 3,761 wstETH. rekt.news rounds to $12 million; the figures are consistent.

### 2. Root cause

The exploit combined two distinct vectors. The first manipulated the rollover pricing formula: the risk premium `rT` used `1/T` where `T` is time-to-expiry, so a trade near expiry (19 minutes before) produced an astronomically inflated risk premium that dominated the HIYA (Historical Implied Yield Average) calculation. After rollover the AMM initialized at a catastrophically low CT price, letting the attacker buy 3,761 Cover Tokens for roughly 0.000003 wstETH. The second and more critical vector exploited the Cork Hook's `beforeSwap` function, which lacked access control: any caller could invoke it and inject spoofed callback parameters (caller address, RA amounts, market ID) that bypassed the FlashSwapRouter's downstream authorization. The attacker deployed a malicious hook contract that spoofed a legitimate Uniswap V4 callback context, tricking the FlashSwapRouter into depositing its unsold DS token reserves into the attacker's proxy market and minting pCT/pDS tokens. Combining the fraudulently obtained CT and DS tokens let the attacker redeem the vault's wstETH through the Peg Stability Module.

- Technical details: https://www.cork.tech/blog/post-mortem (sections 6-7)
- Dedaub cited by rekt.news: "The root cause appears to be an issue in the way an exchange rate is computed. The attacker manipulated this by deploying fake tokens - the protocol contained logic to revert to a default value." https://rekt.news/cork-protocol-rekt
- BlockSec (Lei Wu) cited: "The protocol fails to properly verify the arguments passed to the CorkCall function, allowing the attacker to specify a fake paymentToken." https://rekt.news/cork-protocol-rekt

### 3. Pattern

**Hook callback validation** (missing access control on a Uniswap v4 hook callback). The vulnerability shape: a hook contract's `beforeSwap` (or equivalent callback) is marked `external` without restricting the caller to the PoolManager or an authorized forwarder. Any address can call it and pass arbitrary `hookData`, which downstream router logic trusts without re-verifying the caller's identity or token provenance. In pseudocode:

```
// Vulnerable
function beforeSwap(address sender, PoolKey calldata key,
    IPoolManager.SwapParams calldata params, bytes calldata hookData)
    external returns (bytes4) {
    // No check that msg.sender == poolManager or authorized forwarder
    CorkCallData memory data = abi.decode(hookData, (CorkCallData));
    // data.caller, data.raAmount, data.marketId are all attacker-controlled
    flashSwapRouter.corkCall(data); // trusts the spoofed parameters
}
```

The second pattern is **oracle/pricing manipulation through time-decay**: a formula computing a price or rate from `1/timeRemaining` is unbounded as expiry approaches, allowing a single trade to dominate the moving average that sets the next epoch's price.

### 4. The check that would have caught it

**Unit/invariant test for hook access control**: write a test that calls `beforeSwap` directly from an arbitrary EOA (not the PoolManager or the authorized forwarder contract). Assert that the call reverts. The invariant: "The beforeSwap callback must only be callable by the PoolManager or the protocol's authorized forwarder; all other callers must be rejected."

**Fuzz test for rollover pricing bounds**: fuzz the time-to-expiry `T` from near-zero to full duration with random trade volumes and assert that the resulting risk premium `rT` and HIYA-derived initialization price stay within reasonable bounds (e.g., `rT` < 10,000%, CT initialization price > 1% of RA). The invariant: "No single trade within the last hour of an expiry can shift the rollover initialization price by more than a factor of 100."

### 5. Sources

- https://www.cork.tech/blog/post-mortem (project's own post-mortem, 4 June 2025)
- https://www.cork.tech/blog/lessons-learned (follow-up, 22 July 2025)
- https://rekt.news/cork-protocol-rekt (rekt.news analysis, 30 May 2025)
- https://www.cork.tech/blog/security-framework (Cork's security framework post)
- https://defillama.com/protocol/cork-v1 (DeFiLlama protocol page)

Security firms cited (via rekt.news or Cork's post-mortem): Dedaub, BlockSec (Lei Wu), Cyvers, Blockaid, MistTrack. Cork's post-mortem names Spearbit, Quantstamp, Certora, Hypernative, Hexagate, zeroShadow, and Runtime Verification as war-room participants. No standalone public analyses from these firms were found beyond what rekt.news quotes.