TrustedVolumes RFQ proxy exploited for $5.87M through signature/execution parameter mismatch allowing unauthorized token transfers via unsigned calldata.
Security & Exploits ·
TrustedVolumes' RFQ proxy suffered a $5.87M loss on May 7, 2026, due to a signature and execution parameter mismatch in its fill function. The exploit allowed an attacker to execute unauthorized token transfers by separating signed order parameters from unsigned calldata used in actual execution. While the EIP-712 signature commits to token pairs, amounts, and parties, the unsigned calldata—including the from address and token details—remained unbound to the signed maker, creating an authorization gap.
The attack exploited how the contract's permissionless registerAllowedOrderSigner function interacted with this gap. An attacker registered themselves under a maker they controlled, signed an order with their exploit contract as the maker to pass per-maker authorization checks, then set the unsigned from parameter to the TrustedVolumes Resolver, which held infinite ERC20 allowances to the proxy. The price-loss oracle validated only the signed amounts, allowing a dummy 1:1 order to bypass checks.
The transaction is publicly visible on-chain. Recovery options and whether TrustedVolumes plans to pause operations or implement a fix remain undisclosed.