A transient storage vulnerability leads to the theft of $300,000 worth of assets

On March 30, 2025, a leveraged trading project on the Ethereum chain was attacked, resulting in losses of over $300,000 in assets. The security team conducted an in-depth analysis of the incident, and the results are shared as follows:

Background

Solidity version 0.8.24 introduces transient storage features based on EIP-1153. This is a new data storage location designed to provide developers with a low-cost, temporary storage method that is effective during transactions. Transient storage is implemented through two new EVM instructions, TSTORE and TLOAD, and features low gas costs, persistence within transactions, and automatic cleanup.

Reason for the Attack

The fundamental reason for this incident is that the values stored in transient storage using tstore in the function were not cleared after the function call ended. The attacker exploited this characteristic to construct specific malicious addresses, bypassing permission checks to withdraw tokens.

Attack Steps

1. The attacker creates two malicious tokens A and B, and creates pools for these two tokens on a certain DEX and injects liquidity.

2. The attacker calls the initialize function of the Vault contract to create a leveraged trading market with A token as the collateral token and B token as the debt token.

3. The attacker calls the mint function of the Vault contract, depositing the debt token B to mint leveraged tokens. During this process, the DEX pool address and the minting amount are stored temporarily.

4. The attacker creates a malicious contract with an address that is the same as the value of the second transient storage.

5. The attacker transfers tokens by invoking the callback function of the Vault contract through a malicious contract. Because the transient storage values were not cleared, the identity check was incorrectly passed.

6. Finally, the attacker calls the callback function of the Vault contract through the attack on the contract (Token A) to transfer out other tokens (such as WBTC, WETH) for profit.

Capital Flow Analysis

The attacker stole approximately $300,000 in assets, including 17,814.8626 USDC, 1.4085 WBTC, and 119.871 WETH. WBTC was converted to 63.5596 WETH, and USDC was converted to 9.7122 WETH. Subsequently, a total of 193.1428 WETH was transferred to an anonymous platform. The attacker's initial funding came from 0.3 ETH transferred from that platform.

Summary

The core of this attack lies in the fact that the attacker exploited the characteristic of transient storage that remains unchanged throughout the transaction period, bypassing the permission verification of the callback function. It is recommended that the project team immediately use tstore(key, 0) to clear the values in transient storage right after the function call based on business logic. Additionally, it is important to strengthen contract code auditing and security testing to prevent similar situations from occurring.