The contracts were fine
Nothing was wrong with BadgerDAO’s smart contracts. They were audited, they behaved as written, and they were never exploited. The attack was against the website, using a compromised Cloudflare API key to inject script that asked users for token approvals to an address the attacker controlled.
From the user’s side this was indistinguishable from normal use. You visit the site you always visit, at the correct domain, with a valid certificate, and it asks you to approve a token — which is exactly what it asks every time you deposit.
Unlimited approvals
The reason a front-end compromise converts into a nine-figure loss is the token approval model. Approving a spender for an unlimited amount is the default in most interfaces because it saves gas and avoids repeated prompts. It also means a single approval granted to the wrong address is a standing authorisation over your entire balance of that token, for as long as it remains in place.
Approvals are public. Any block explorer will show what your address has approved and to whom. Reviewing them periodically is a check anyone can run, and it is the reason this incident is worth reading even years later.
Where Conisec stops
We are not going to tell you to revoke anything, and we do not link revocation tools. After incidents of this kind, fake “revoke” and “recovery” sites appear quickly and rank well, and a publication that routinely sends readers to approval-management interfaces is training exactly the habit attackers exploit. The approval list is visible in the block explorer you already trust. Start there.
Timeline
Append-only. Corrections are added as their own dated entry; earlier entries are never rewritten.
What to check
BadgerDAO published a technical post-mortem, linked below. Token approvals are visible on-chain and can be inspected via any block explorer's approval view for your own address.
Conisec does not host or link recovery, revocation or "checker" tools. After a public incident, attackers routinely seed exactly those links using the names of publications covering the story. Use the affected project's own official channel, linked above, and nothing else.
Sources
- BadgerDAO, Technical post-mortem (2 Dec 2021)
Not advice. This is a summary of published facts, not legal, tax or security advice. Verify against the primary sources linked above.
Last verified by Conisec Staff.
