Giddy.co's GiddyVaultV3 exploited for $1.3M via incomplete EIP-712 signature validation allowing signature replay with modified swap parameters.
Security & Exploits ·
Giddy.co's GiddyVaultV3 contract suffered a $1.3M loss on April 23 after an attacker exploited incomplete signature validation in the protocol's authorization mechanism. The vulnerability allowed signature replay attacks by circumventing security checks designed into the EIP-712 signing standard.
The flaw lay in how _validateAuthorization() processed signatures for swap operations. While the function verified signatures covering only the data bytes within SwapInfo structures, it failed to validate critical fields including the aggregator address, token inputs, token outputs, and transfer amounts. An attacker leveraged this gap by reusing a legitimate signature while modifying the underlying swap parameters—redirecting the strategy's staked LP tokens through an attacker-controlled aggregator contract to a fraudulent token, with the amount set to MAX_UINT256 to drain available liquidity.
The incident drew attention from multiple security observers tracking the exploit chain, with reports indicating roughly $1.25M in wrapped bitcoin was extracted across three separate Giddy vaults using custom contract interactions. The precise scope of affected positions and whether remediation measures have been deployed remain unclear.