Velocore Fee-Multiplier Overflow

On June 2, 2024, the decentralised exchange Velocore — deployed on both zkSync Era and Linea — was drained for approximately $6.8 million in ETH through a precision/overflow bug in the fee-multiplier logic of its Balancer-style CPMM pool contract.

What happened

Velocore's CPMM (Constant Product Market Maker) pools used a fee-multiplier parameter that scaled with the size of withdrawals to discourage liquidity siphoning. The intended behaviour: large withdrawals pay larger fees.

The attacker found that the fee calculation had no upper bound check and could overflow into nonsense values:

1. The attacker invoked velocore__execute() directly, simulating a huge withdrawal to push the feeMultiplier to an artificially inflated value.
2. With the multiplier set, effectiveFee1e9 (the per-transaction fee parameter, scaled to 1e9) overflowed past 100% — into wraparound territory where the math broke down.
3. Using a flash loan, the attacker initiated the actual withdrawal. The broken fee math caused the contract to compute the swap output incorrectly.
4. A subsequent small single-token withdrawal triggered an underflow elsewhere in the liquidity-token mint logic, allowing the attacker to mint a hugely disproportionate amount of LP tokens.
5. The flash loan was repaid and the attacker walked with ~1,807 ETH, which they bridged to Ethereum mainnet and laundered through Tornado Cash.

Aftermath

• Velocore reached out via on-chain messages offering a 10% white-hat bounty; deadline passed without response.
• The protocol had previously been audited by Zokyo, Hacken, and Scalebit — none of which had flagged the multiplier overflow path.
• Velocore paused operations on zkSync and Linea and effectively wound down.

Why it matters

Velocore is one of a small set of post-audit exploits that highlight the limits of audit-as-defence-in-depth: three reputable audit firms reviewed the code and the bug still shipped. The likely reason is that audit scope rarely includes fuzzing with arbitrary integer ranges across every state-mutating function — and the specific path that overflowed feeMultiplier was reachable only by a particular sequence of simulate + execute calls that no static analysis tool flagged.

Industry response has been to layer audits with economic invariant testing (Echidna, Foundry invariants) that check business-logic properties under random sequences of calls, not just the standard "does this branch revert?" gauntlet.