THORChain Hack

The July 15 THORChain hack exploited a vulnerability in the protocol's ETH Router contract, which handles the cross-chain swapping of Ethereum-based assets. The attack was sophisticated and took advantage of how the router processed certain transactions:

1. The attacker created a custom contract that mimicked a legitimate router
2. When interacting with THORChain, they tricked the protocol into processing their deposit as ETH when it was actually an ERC-20 token
3. This confusion in asset type validation allowed them to extract more value than they put in
4. The attacker repeated this process multiple times, draining funds from the protocol

The vulnerability existed in how the router contract validated incoming assets:

// Simplified representation of the vulnerable router code
function depositAsset(address asset, uint256 amount) external {
    // Vulnerability: Insufficient validation of asset types
    if (asset == address(0)) {
        // Handle ETH deposit
        require(msg.value == amount, "Amount mismatch");
        // Process ETH deposit
    } else {
        // Handle ERC-20 deposit
        IERC20(asset).transferFrom(msg.sender, address(this), amount);
        // Process ERC-20 deposit
    }
    
    // Issue assets on THORChain
    _issueTHORChainAssets(asset, amount);
}

The key vulnerability was that the contract didn't properly differentiate between native ETH and wrapped tokens in certain edge cases, allowing the attacker to confuse the system about what type of asset was being deposited.