A Missing Modifier Cost Punk Protocol $8.95M — Then a Frontrunning Bot Clawed Most of It Back

On August 10th, Punk Protocol — a platform planning to offer a DeFi annuity product backed by ETH, WBTC and various stablecoins — was hacked for $8.95 million. Roughly $5 million of that was later recovered, though not without a cut going to the party that intervened.

The setup

The project had structured a Fair Launch intended to funnel $3 million in deposits into three separate stablecoin pools: USDC, DAI, and USDT.

According to Punk's own post-mortem, the vulnerability traced back to a missing "initializer" modifier on the initialize() function inside the CompoundModel contract.

How the exploit worked

The attacker called initialize() on CompoundModel and, via delegateCall(), passed in their own malicious contract as the parameter meant to represent the protocol's legitimate forgeAddress. Because the function lacked an initializer guard, it executed without checking whether it was being called against a known, trusted contract — so the swap went through unchecked.

With forgeAddress now pointed at the attacker's contract, they called withdrawToForge, which routed the assets held by CompoundModel straight into the malicious contract and from there into their own wallet. Normally, withdrawals are gated by an OnlyForge modifier — but since initialize() had already (fraudulently) set the malicious address as the legitimate forge address, that check saw nothing out of place.

The stolen USDC was swapped for ETH via 1inch and then moved into Tornado Cash in a series of 100 ETH transactions. The other two pools' assets were not laundered this way, because a third party intervened before that could happen.

The frontrunner steps in

The attack only fully succeeded against one of the three pools. The operator of an automated frontrunning bot noticed the malicious transactions and repurposed the tool to intercept the remaining funds — effectively racing the attacker rather than simply letting the exploit run. This person made their intentions known through transaction input data, which opened a line of communication via email with the Punk team.

Key transactions:

• Original attack: 0x7604c7dd6e9bcdba8bac277f1f8e7c1e4c6bb57afd4ddf6a16f629e8495a0281
• Whitehat frontrun: 0x597d11c05563611cb4ad4ed4c57ca53bbe3b7d3fefc37d1ef0724ad58904742b

The frontrun wasn't flawless. As the whitehat later admitted:

Unfortunately, it looks like my frontrun was not perfect, as I did end up sending $3M USDC to the original hacker. Rewriting txs can be tricky.

Negotiating the return

Per the post-mortem account, a subsequent exchange between the whitehat and the Punk team resolved suspicions that the incident had been an inside job. The anonymous rescuer set a bounty of $1 million for themselves; after a token attempt to negotiate a lower figure, Punk accepted the terms, and the remaining roughly $5 million was returned:

• ~$1.95M DAI: 0x008dd92f8bcfcee400aed26d13495fbfc8351f9b21289792fc2bb9e771668147
• ~$3M USDT: 0xace7c07695ec1bbf917486c3c81ee7de79c04e0309d4f6a149688463e6f83247

Punk Protocol stated that the recovered funds would go toward compensating affected users, with a further update promised within days. The team also said it was still holding out hope that the original attacker might return additional funds — though any such gesture would be dwarfed by the scale of the Poly Network incident that had broken just one day earlier.

The uncomfortable question

The rescuer kept 16% of the funds they intercepted — about $1 million — effectively forcing that fee onto Punk Protocol as a condition of returning the rest. It raises a fair question about where the line sits between a white hat and an opportunist: recovering assets is unambiguously better than losing them outright, but the money taken as a "bounty" could otherwise have gone straight back to the users it belonged to. In a space where security researchers can often earn far more by exploiting a bug than by responsibly disclosing it, incidents like this underscore an uncomfortable incentive structure — whitehats effectively name their own price, while the auditors who miss these bugs in the first place merely collect a salary and the blame.