StrongBlock Governance Takeover — Abandoned Governor → Malicious Upgrade → Pool Drain

Source & credit. Crypto Training original detection and analysis (live Twitter/X security-alert intake — not from DeFiHackLabs). Standalone Foundry PoC, offline anvil_state.json, and full write-up: 2026-08-StrongBlockGovernanceTakeover_exp in the evm-hack-registry mirror.

Vulnerability classes: vuln/access-control/missing-auth · vuln/governance · vuln/logic/incorrect-state-transition

Key info#


Loss	~$72K — 32,695.76 STRONG + 383,447.17 STRNGR
Chain	Ethereum mainnet
Protocol	StrongBlock (`@Strongblock_io`)
Attacker EOA	`0xACBCa357…810c`
Governor proxy	`0xBDDC7Ef8…B8C1`
Upgrader	`0x75C53809…1C61`
Drain pool / helper	`0x53cA51Ba…38Fc`
Malicious impl	`0xf6c7c78f…e285` (`forward(address,bytes)` gated to attacker)
Drain tx	`0x3ffa7f6d…0401` (block 25691527, `run()`)
Upgrade tx	`0x92be5e37…94c6` (block 25691700, Upgrader `upgrade`)
Alert	DefimonAlerts 2026-08-06
Bug class	Abandoned on-chain Governor + cheap majority of near-worthless STRONG vote token → admin seizure → malicious proxy upgrade → arbitrary calls / pool drain

TL;DR#

StrongBlock left an on-chain Governor with live upgrade authority, while the STRONG vote token was economically worthless — so majority voting power was cheap.
Attacker used governance to call setPendingAdmin on the Governor’s Upgrader, then claimed admin of the Governor proxy.
They upgraded the proxy to a minimal implementation exposing forward(address,bytes) hard-gated to the attacker EOA (arbitrary-call backdoor under Governor authority).
Separately (and in this PoC’s economic replay), the attacker called run() on a StrongBlock pool helper that transferred ~32.7k STRONG + ~383k STRNGR to the attacker.

Attack walkthrough#

flowchart LR A[Acquire STRONG majority] --> B[Gov: setPendingAdmin on Upgrader] B --> C[Claim Governor proxy admin] C --> D[Upgrade Governor to forward backdoor] A --> E[Call pool.run 0xc0406226] E --> F[STRONG + STRNGR to attacker EOA]

A. Governance / upgrade path (on-chain narrative)#

Acquire majority STRONG voting weight (abandoned protocol economics).
Propose / vote / queue / execute Upgrader admin change toward attacker.
upgrade(GovernorProxy, MaliciousImpl) via Upgrader (0x99a88ec4).
Malicious impl: only forward(address,bytes) for msg.sender == attacker.

B. Economic drain (PoC reproduces this)#

Pre-state (block 25691526): inventory proxy 0x53cA…38Fc (OpenZeppelin AdminUpgradeabilityProxy) holds the STRONG/STRNGR balances.
Implementation 0xE89C…4106 exposes run() (0xc0406226) with hardcoded pool / STRONG / STRNGR / attacker addresses — no access control; recipient is baked into bytecode.
Attacker (or any caller) invokes run() on the proxy → DELEGATECALL → transfers full STRONG + STRNGR balances to the attacker EOA.
Attacker later sells inventory (1inch / Uniswap paths) and continues upgrade cleanup.

PoC scope. The Foundry / EVM Playground PoC replays the economic drain at the pre-drain block. Governance control is already established on-chain by that point; the playground story anchors on the verified proxy + ERC-20 transfers (the drain impl is unverified bytecode-only).

PoC#

BASH

cd 2026-08-StrongBlockGovernanceTakeover_exp
MAINNET_RPC_URL=... forge test --match-test testExploit -vvv

Expected: [PASS] testExploit() with 32695.76 STRONG and 383447.17 STRNGR profit.

References#

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 2026-08-StrongBlockGovernanceTakeover_exp (evm-hack-registry mirror).
Attack transaction: view on explorer.

Alerts & third-party analyses

Original alert / thread: post on X.
Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync