Cork V1
HackedDeFi · born 2024 · ✝ 2025
A malicious hook walked past the access control.
Cork V1 was an Ethereum DeFi protocol for hedging depeg risk on pegged assets. In 2025 an attacker bypassed access control through a hook to drain roughly $12M.
- Peak
- ~$12M stolen
- Cause
- Hacked
- Year of death
- 2025
☠️ Cause of death
An access-control bypass executed via a crafted hook let the attacker invoke privileged logic and siphon funds from the protocol.
📓 Lessons left behind
- —Hooks and callbacks must inherit the same access checks.
- —Plug-in extension points are prime privilege-escalation paths.
- —Audit every entry point a hook can reach, not just the main flow.
🌱 The idea that survived
Hardened hook permissions
Reinforced that extensible hook architectures need strict, comprehensive access control on every callable path.
#defi#access-control#hook#ethereum