Fuse Network's ERC677 Callback Flaw Drains $4M From Voltage Finance via Ola Finance

Voltage Finance lost roughly $4 million after attackers exploited its lending infrastructure, which runs on Ola Finance's "Lending-as-a-Service" product on the Fuse Network.

Ola does not consider itself a Compound fork. Per its own documentation, it describes itself instead as "a technology provider that enables others to build Compound-like instances."

Earlier the same month, a nearly identical exploit hit Agave and Hundred Finance on the Gnosis (formerly xDAI) chain, giving every team running Compound-derived code advance warning to check for the same weakness. Neither Voltage nor Ola appears to have acted on it in time.

The mechanism

As in the Agave/Hundred case, the vulnerability traced back to a reentrancy issue tied to the ERC677 token standard that Fuse Network uses for its bridged assets. ERC677 tokens carry a callAfterTransfer() function that can trigger additional transfers before account balances are updated, if the receiving contract doesn't strictly enforce the checks-effects-interactions pattern. Compound's original code avoids this pitfall, and collateral tokens proposed for the protocol are normally screened for exactly this flaw before being approved — a safeguard that evidently failed here.

Security firm BlockSecTeam traced the attack to a wallet on Fuse, 0x371D7C9e4464576D45f11b27Cf88578983D63d75, with an example BUSD transaction showing the pattern in action. Two attacker-controlled contracts executed the exploit: Contract A and Contract B.

The sequence ran: Contract A sent 550 WETH to Contract B. Contract B deposited that WETH and received 27,284 oWETH in return. Contract B then borrowed 507,216 BUSD. The BUSD transfer triggered a callback into Contract B via callAfterTransfer(). Inside that callback, Contract B forwarded both the 507,216 BUSD and the 27,284 oWETH to Contract A. Contract A then used the oWETH to redeem the original 550 WETH deposit, keeping the 507,216 BUSD as clear profit — all before the protocol's internal accounting had a chance to catch up.

BlockSecTeam summarized the flaw: "In the code logic of the borrow() function, the related internal states are updated after an external call. Specifically, the doTransferOut() function will invoke the transfer() function of the ERC677-based token, which will eventually lead to an external call."

The attacker repeated this same pattern to also drain USDC, FUSD, WBTC, WETH, and FUSE from the protocol. The stolen assets were bridged over to Ethereum — the attacker's Ethereum wallet had itself been funded via Tornado Cash — before being moved on to a further address, where the funds currently sit as ETH, WBTC, USDC, and FUSE worth an estimated $3.1 million. Whether Circle freezes the USDC portion remains to be seen.

A warning left unheeded

Commenting on the earlier Agave and Hundred Finance incident, the takeaway at the time was that once one Compound fork falls to a given attack vector, every other fork needs to check its own foundations. Voltage Finance didn't make that check, and now sits at #64 on rekt.news's exploit leaderboard as a result.