Front-end compromise
BadgerDAO Front-End Injection, December 2021: What Happened & What to Check
A compromised Cloudflare API key let attackers inject approval-harvesting script into the BadgerDAO front end. The contracts were never touched.