Drips protocol DaiDripsHub contract exploited for $24,882 via signed-integer overflow in _give function; vulnerability patched in new version.
Security & Exploits ·
An attacker exploited a signed-integer overflow vulnerability in the DaiDripsHub contract, a component of the Drips protocol, to drain approximately $24,882 from the DaiReserve. The exploit leveraged a flaw in the _give function, which lacked upper-bound validation before casting user-supplied amounts to signed 128-bit integers. By submitting an amount exceeding 2^127, the attacker caused the cast to wrap into negative territory, inverting the function's logic from a deposit operation into a withdrawal that funneled reserve funds to the attacker's address.
The vulnerability stemmed from the function's design to call _transfer(user, -int128(amt)), which relied on integer conversion to negate the amount. When amt was set to 2^128 minus the reserve balance, the negative conversion produced a positive value that bypassed the intended deposit logic entirely. The protocol team subsequently patched the flaw in a new version, eliminating the vulnerability from active deployments.
The team has begun tracing affected addresses to determine next steps, though no further details on recovery efforts or additional losses have been disclosed. The exact timeline and scope of the vulnerability's exposure remain unclear.