Aerodrome V6 Unauthorized Reward Harvest via Forged Depositor Assignment

1. Incident Overview TL;DR

An unprivileged actor on Base exploited Aerodrome CL Position Manager V6 (0xeb2bd37d47c98d7739b4606eaeffc46f1e519bab) by forging depositor ownership for existing position tokenIds, then harvesting gauge rewards to an attacker-controlled recipient.

The critical flaw is authorization coupling: batchHarvest trusts depositors[tokenId], while depositUnstaked allows writing depositors[tokenId] through an attacker-controlled pool -> nft() resolution path. A spoofed NFPM can satisfy safeTransferFrom without proving canonical NFT custody.

This was repeatedly realized across adversary-crafted transactions until the protocol owner paused V6. Observed total extracted value is 199931656475035207998 wei-AERO, credited to 0x1e221ee4abcf419872e71ea403e9a7ca52b784f5.

2. Key Background

Aerodrome V6 uses depositor state as an authorization primitive for reward harvesting.

depositors[tokenId] is a security-critical mapping.
_resolveNFPM(pool) resolves NFT manager as ICLPool(pool).nft().
batchHarvest checks only depositors[tokenId] == msg.sender (or owner override), then calls gauge .

Aerodrome V6 Unauthorized Reward Harvest via Forged Depositor Assignment

USD Estimate Context

Token Loss Details

Exploit Transactions

Victim Addresses

Similar Incidents

Veil01ETH forged-proof drain on Base

Unauthorized Vault Approval Drain

MoltEVM Fake Spawner Drain

Root Cause Analysis

Aerodrome V6 Unauthorized Reward Harvest via Forged Depositor Assignment

1. Incident Overview TL;DR

2. Key Background

CAROL Reward Inflation Drain

MPRO Staking Proxy unwrapWETH Flash-Loan Exploit (Base)

Xocolatl Zero-Cost Liquidations

3. Vulnerability Analysis & Root Cause Summary

4. Detailed Root Cause Analysis

4.1 Deterministic exploit mechanism

4.2 State-diff confirmation of authorization overwrite

4.3 Mitigation and failed replay

5. Adversary Flow Analysis

5.1 Adversary-related accounts

5.2 Lifecycle stages with concrete transactions

5.3 Full relevant transaction set

6. Impact & Losses

7. References