Revert Finance Hack

Revert Finance offers analytics and tools for people who provide liquidity on Uniswap V3. Its V3Utils contract powered a new feature that let users swap tokens and add them to a Uniswap V3 position in a single transaction, and users approved V3Utils to spend their tokens to do this. The contract let the caller decide which contract would carry out the swap, but never checked that it was a real swap router. On 18 February 2023, an attacker pointed it at token contracts like USDC instead, making V3Utils move tokens out of the wallets that had approved it.

Users on chains including Ethereum and Polygon were hit, with total losses of just under $30k. Revert disabled the feature in its app within hours, published the affected contract addresses on Ethereum, Polygon, Optimism and Arbitrum, and urged users to revoke their approvals. It also ran its own bot to rescue remaining vulnerable funds before attackers could take them. By the end of that weekend, all affected users had been refunded in full, with tokens sent back to them on each network.

V3Utils was deliberately deployed without an owner and cannot be changed, so it cannot be paused or patched. The flaw is still exploitable today, and any approval that remains can still be used to take tokens. If you ever approved Revert's V3Utils contract on Ethereum, Polygon, Optimism or Arbitrum, revoke that approval now. After the incident, Revert said all of its future contracts would be audited by outside firms before launch.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.