Hedgey Finance Approval Bug

On April 19, 2024, the DeFi vesting and token-distribution protocol Hedgey Finance suffered dual exploits across Arbitrum (~$42.6M) and Ethereum (~$2.1M) for a combined $44.7M loss. The bug was a missing parameter check on a single contract function.

What happened

Hedgey provided vesting and claim campaigns — projects could lock tokens in Hedgey contracts and let recipients claim their share according to vesting schedules. The contract function createLockedCampaign was responsible for setting up new campaigns and accepted several parameters describing the campaign's lockup terms.

The function validated most of those parameters — but not the claimLockup configuration, which determined which token transfers and approvals were attached to each claim. By submitting a createLockedCampaign call with a malicious claimLockup, the attacker could make the contract issue approvals on the victim's tokens to an address of the attacker's choice.

A flash loan funded the temporary capital needed to set up the malicious campaign and trigger the approval pattern. Once the approvals existed on-chain, the attacker called transferFrom and drained tokens — USDC, NOBL, MASA, BONUS — from accounts whose owners had ever interacted with the Hedgey contracts.

Aftermath

• Hedgey paused affected contracts and sent an on-chain message to the attacker requesting a return of funds and offering white-hat treatment.
• The team migrated to a redesigned campaign contract with explicit validation on every parameter.
• The attacker did not respond to the bounty offer; funds were laundered.

Why it matters

Hedgey reinforced the unglamorous truth that every input parameter is part of the trust boundary — particularly in protocols that take callback configuration from users. A single unchecked field on a privileged setter function is enough to compromise an entire protocol; the defensive answer is deny-by-default parameter allowlists, formal verification of complete-parameter coverage, and contract-level invariants that cannot be violated by any combination of inputs.