Unagii Hack

Unagii is a DeFi yield platform from the team behind StakeWithUs, where users deposit tokens into vaults that earn yield. Its WETH vault came with a helper contract, the WethZap, that let users wrap or unwrap ETH and use the vault in a single transaction. In June 2023, it turned out that this helper was missing an ownership check. Anyone could use it to withdraw vault funds belonging to other users who had approved it, and keep the ETH for themselves.

On 28 June 2023, an automated trading bot noticed the flaw and used it to grab 30.86 ETH, worth about $58k, from vault funds belonging to users who had approved the helper. Dezy Finance, which had built an integration with Unagii, alerted the team. Unagii then used the same flaw to move the remaining at-risk funds, about $94k, to a wallet it controlled, so no further funds were lost. The team returned the rescued funds and reimbursed the affected users the same day.

Unagii paused deposits into the vault and said it would deploy a new version of the helper contract, but the old one was never fixed. At the time, Unagii said funds in the vault were safe as long as there was no approval to the old helper contract, yet some wallets still hold unlimited approvals to it. If you ever used Unagii's WETH vault, revoke any approvals to this contract to make sure your vault funds cannot be taken.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.