weETH LRT Minter Exploit — Unprotected `0x03b79c24(address)` Token Sweep

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2025-07-unverified_54cd_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/unverified_54cd_exp.sol.

Vulnerability classes: vuln/access-control/missing-auth · vuln/access-control/missing-modifier

Reproduction: the PoC compiles & runs in an isolated Foundry project at this project folder (the umbrella DeFiHackLabs repo contains many unrelated PoCs that do not whole-compile, so this one was extracted). Full verbose trace: output.txt. The vulnerable logic contract is unverified on Etherscan; its behavior was reconstructed from on-chain bytecode disassembly + the execution trace. The ERC-1967 proxy in front of it is verified: openzeppelin_contracts_proxy_ERC1967_ERC1967Proxy.sol.

Key info#

TL;DR#

The vulnerable contract is a liquid-restaking-token (LRT) minter for weETH (its dispatch table exposes depositWeEth(uint256,address,address,bool), mintNrETH(), userLstBalances(address), underlyingToLstRate(), getRate(), reprice(), multichainMintActive(), setMultichainManager(address), all behind a UUPS proxy and a SphereX security firewall). It custodies user-deposited weETH while it mints/bridges its LST.

It also exposes a function with selector 0x03b79c24(address recipient) that, with no access-control check, reads the contract's entire weETH balance via weETH.balanceOf(address(this)) and transfers it to whatever recipient the caller passes in the calldata. This is a classic "token rescue / sweep" helper that was shipped without an onlyOwner / role guard.

The attacker simply:

1. Called 0x03b79c24(attackerContract) on the proxy → received 106.929468 weETH for free.
2. Sold that weETH for 114.534060 WETH through the Uniswap V3 WETH/weETH pool (paying the borrowed weETH back inside the V3 swap callback).
3. Unwrapped WETH → ETH and forwarded 114.534060 ETH to the attacker EOA.

No flash loan, no price manipulation, no preconditions beyond "the minter is holding weETH." One call.

Background — what the contract does#

The logic contract behind proxy 0x54Cd…3525 is unverified, but its 4-byte dispatch table (recovered with cast disassemble + cast 4byte) cleanly identifies it as a weETH-collateralised liquid (re)staking token minter with multichain support and a SphereX on-chain firewall:

The proxy in front of it is a stock OpenZeppelin v5 ERC1967Proxy (ERC1967Proxy.sol:26-28), delegating all calls to the implementation stored in the EIP-1967 slot (_meta.json → "implementation": "0xbc4b1d…0672cc").

On-chain facts at the fork block (read via cast):

That single fact — the minter was holding ~107 weETH of user deposits with a public, unguarded sweep function — is the entire exploit.

The vulnerable code#

The logic contract is unverified, so there is no Solidity to quote. Here is the decompiled handler for selector 0x03b79c24, recovered from the on-chain bytecode of 0xBc4b1D…0672cC (disassembly excerpt, produced with cast disassemble). It maps 1:1 to the trace:

; --- function dispatch (no auth, no msg.sender check anywhere on this path) ---
0000002f: PUSH4 0x03b79c24      ; selector
00000034: EQ
00000035: PUSH2 0x2506          ; jump to handler if match
00000038: JUMPI

; --- handler @ 0x2506: balanceOf(this) then transfer(arg0, balance) ---
00002524: PUSH1 0x03 SLOAD       ; load custodied token = weETH (slot 3)
00002527: PUSH4 0x70a08231 ...   ; selector balanceOf(address)
00002531: ADDRESS                ; arg = address(this)  → balanceOf(this)
0000254a: GAS STATICCALL         ; weETH.balanceOf(address(this)) → full balance
...
000025a4: PUSH1 0x04 CALLDATALOAD ; arg0 = caller-supplied recipient (the ONLY input)
...                               ; (a9059cbb) weETH.transfer(recipient, balance)

Reconstructed in Solidity, the function is equivalent to:

// selector 0x03b79c24 — NO access control
function rescue(address recipient) external {
    uint256 bal = weETH.balanceOf(address(this)); // slot 3 = weETH
    weETH.transfer(recipient, bal);                // send EVERYTHING to caller's choice
}

The execution trace proves exactly this behavior (output.txt:1574-1589):

0x54Cd…3525::03b79c24(…be367…357f9)                       ; attacker contract as recipient
└─ 0xBc4b1D…0672cC::03b79c24(…be367…357f9) [delegatecall]  ; proxy → impl
   ├─ weETH.balanceOf(0x54Cd…3525) → 106929468097270451433 ; reads full custodied balance
   └─ weETH.transfer(AttackerC, 106929468097270451433)     ; sends ALL of it to attacker
       emit Transfer(from: 0x54Cd…3525, to: AttackerC, value: 106.929468 weETH)

There is no require(msg.sender == owner), no role check, no SphereX revert on this path — the call succeeds for an arbitrary externally-controlled msg.sender and an arbitrary recipient.

Root cause — why it was possible#

A privileged "rescue/sweep" helper — the kind teams add so an admin can recover stray tokens — was deployed without an access-control modifier. Three properties compose into a critical loss:

1. Missing authorization. 0x03b79c24 performs a privileged action (moving the contract's entire custodied weETH) but checks nothing about msg.sender. Anyone can call it.
2. Caller-controlled destination. The single address argument is used verbatim as the transfer recipient, so the attacker directs the funds straight to a contract they control.
3. Whole-balance transfer. It sweeps balanceOf(address(this)), not a bounded/owed amount, so the one call drains 100% of user deposits in a single shot.

Note the contract was wrapped in a SphereX firewall (sphereXEngine, changeSphereXOperator, …) — an on-chain runtime guard meant to block anomalous flows. It did not stop this call: the firewall hooks guard configured functions, but this sweep path was reachable and executed normally, underscoring that runtime firewalls are no substitute for a correct onlyOwner/role check on a privileged function.

Because the swept asset (weETH) is liquid and has a deep Uniswap V3 pool, the attacker monetised it immediately and atomically — no need to hold or launder anything.

Preconditions#

• The minter is holding weETH (it was custodying ~106.93 weETH of user deposits at the block).
• The attacker knows the selector 0x03b79c24 and that it has no auth (trivially discoverable by scanning the unverified contract's bytecode or by simulation).
• A liquid market to sell the swept weETH — the Uniswap V3 WETH/weETH 0.01% pool had > 114 WETH of WETH-side reserves, easily absorbing the sale.
• No flash loan, attacker capital, timing window, or oracle manipulation is required. The PoC starts the attacker EOA with only 0.42 ETH (used for nothing but gas headroom).

Attack walkthrough (with on-chain numbers from the trace)#

All figures are taken directly from the events/returns in output.txt.

The pool's weETH reserve went 2,430.71 → 2,537.64 weETH and its WETH reserve dropped by the amount paid out — a normal swap; the theft was entirely in step 1, the swap merely converted the stolen weETH into ETH at market.

Profit / loss accounting#

Net attacker profit ≈ 114.53 ETH (the swept weETH had zero cost basis). The PoC's logged delta is 114.958616 − 0.424556 = 114.534060 ETH, equal to the swap output — confirming the entire gain is the liquidated value of the stolen 106.93 weETH. At ~$2,494/ETH this is ≈ $285.6K, matching the reported $285.7K loss.

Diagrams#

Sequence of the attack#

Minter balance / state evolution#

The flaw inside 0x03b79c24#

Remediation#

1. Gate the privileged function. Any function that moves the contract's funds (a rescue/sweep, an admin withdraw, or a treasury transfer) must enforce authorization — onlyOwner, onlyRole(RESCUER_ROLE), or a timelock/multisig. The single missing modifier here is the whole bug.
2. Don't ship unbounded whole-balance transfers. If a rescue helper is genuinely needed, scope it to tokens the protocol is not supposed to custody (e.g., disallow the core asset weETH), or require the caller to specify and the contract to validate the exact amount, never balanceOf(this).
3. Verify deployed source. The contract was unverified on Etherscan; an unprotected sweep is the kind of bug audits and source review catch trivially. Verify and publish source, and run access-control linting (e.g., Slither's arbitrary-send, suicidal, unprotected-upgrade detectors).
4. Treat firewalls as defence-in-depth, not the gate. SphereX (or any runtime firewall) should supplement, not replace, in-code authorization. Ensure every state-mutating, fund-moving selector is covered by the firewall policy and by an explicit on-chain auth check.

How to reproduce#

The PoC was extracted into a standalone Foundry project (the umbrella DeFiHackLabs repo has many unrelated PoCs that fail to compile under a single forge test build):

_shared/run_poc.sh 2025-07-unverified_54cd_exp -vvvvv

• RPC: an Ethereum mainnet archive endpoint is required (fork block 22,855,568). foundry.toml's mainnet alias points at an Infura archive endpoint.
• Result: [PASS] testPoC(), with the attacker's ETH balance rising from 0.424556 to 114.958616 (net +114.534060 ETH).

Expected tail:

Ran 1 test for test/unverified_54cd_exp.sol:ContractTest
[PASS] testPoC() (gas: 680943)
Logs:
  before attack: balance of attacker: 0.424556186910691996
  after attack: balance of attacker: 114.958616077792713480

Reference: TenArmor post-mortem — https://x.com/TenArmorAlert/status/1941689712621576493 (weETH minter, Ethereum, ~$285.7K).

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2025-07-unverified_54cd_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: unverified_54cd_exp.sol.
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• DeFiHackLabs incident explorer: search "weETH LRT Minter Exploit".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.