Introduction

CrossCurve is a cross-chain yield protocol, powered by the Curve AMM. It aims to enable efficient swaps and access to deep liquidity via its consensus bridge.

The Consensus Bridge is its data transfer protocol, that integrates with many bridge services like Axelar, LayerZero and CCIP, and relies on them to help users earn access to more yield opportunities.

On Feb 1, at 06:38 PM UTC, the PortalV2 contract from Crosscurve (previously known as eywa.fi) was exploited to extract a total estimated $3M USD worth of funds. The first part of the attack happened on Ethereum Mainnet, followed by the same exploit targeting PortalV2 on Arbitrum and extracting tokens like $EYWA, $USDT0 among others.

Within hours, the CrossCurve team swung into action : they setup a war room with MixBytes to investigate the root cause, while taking the following measures to contain the damage : The backend was taken offline and, router contracts in all networks began to be put on pause.

Chinmay, Security Researcher at Cantina, emphasizes that-

• Extra caution is required when combining multiple services into a single system, particularly when it involves bridging funds. Since bridges play a critical role in enabling interoperability, maintaining their security is vital for preserving trust and ensuring the wider adoption of DeFi systems

Below we break down the vulnerable code and the actual steps taken by the attacker.

Analyzing the exploit

How does CrossCurve’s Consensus Bridge work ?

From the CrossCurve docs :

• Unlike the traditional PoA (proof-of-authority) solutions, the CrossCurve Consensus Bridge uses a validation model based on agreement between independent data transmission protocols. This architecture involves Axelar, LayerZero, Router Protocol, Asterizm and Chainlink CCIP. A transaction is completed only if consensus is reached among multiple sources. If the data diverges, the transaction is automatically rejected, preventing potential compromise and ensuring the safety of user funds.

This information will be important when we discuss the cause of the exploit.

The Consensuss Bridge integrates Axelar via its ReceiverAxelar contract, and this contract was the primary entry point for the attack.

The ReceiverAxelar contracts inherits from Axelar GMP SDK’s AxelarExpressExecutable contract (v 5.10) here.

This AxelarExpressExecutable contract includes a dangerous design pattern with the expressExecute() function, which if not handled carefully, can lead to critical access control issues. This is exactly what the attacker used to drain funds from CrossCurve’s Portal.