The Red Village NFT game exploited for $80.7K on Polygon via public router function allowing unauthorized proxy upgrade and delegatecall backdoor.
Security & Exploits ·
The Red Village, an NFT fighting game on Polygon, suffered an exploit on September 21 that drained approximately $80.7K in user funds. The attack exploited a public router function that allowed an attacker to upgrade the SeasonService proxy contract to a malicious implementation containing a delegatecall backdoor. Within thirteen minutes, the compromised contract was used to extract WETH from roughly 299 player wallets that had granted approval to TRVZooKeeper, draining 31.43 WETH from the contract's balance.
The vulnerability stemmed from PolygonTRVRouter.forwardRequest() being publicly accessible, allowing the attacker to call registered services with arbitrary calldata. Since the router held the "_authorizeUpgrade" role, it could invoke the upgradeTo function on the proxy and direct it toward the attacker's own contract. The backdoor was gated to execute only from the attacker's transaction origin, restricting execution to authorized calls.
Following the exploit, the stolen funds were bridged out via LI.FI. Two weeks after the attack, an onchain message appeared attempting to negotiate a bounty settlement. The incident underscores risks associated with overly permissive access controls and proxy upgrade mechanisms in DeFi protocols.