Fusion optimizer on Arbitrum suffers EIP-7702 permission attack, losing 336,000 USDC

ZkSnarker · 2026-01-07T02:44:12+00:00

The Fusion USDC optimizer Vault in the Arbitrum ecosystem was attacked on January 6th, resulting in a loss of $336,000. The attack was caused by a flaw in the Vault code logic and a lack of understanding of EIP-7702, leading to weak permission management. Fusion officials stated that they will use DAO funds to compensate users for their losses and are working with security companies to track the stolen funds.

ZkSnarker

2026-01-07 02:44:12

Abstract generation in progress

【ChainNews】Arbitrum ecosystem faces issues again. The USDC optimizer Vault launched by Fusion was attacked on January 6, resulting in a loss of $336,000.

The cause of the incident is quite typical—the old version of the Vault code did not properly validate the “fuse” logic, giving hackers an opportunity. Even more seriously, the attacker exploited EIP-7702, manipulating the administrator permissions through this mechanism, injecting malicious logic modules, and ultimately transferring the funds to Tornado.Cash.

From a technical perspective, this incident is actually a combination of two vulnerabilities: one is a logical flaw in the contract itself, and the other is weak permission management due to insufficient understanding of new Ethereum features (EIP-7702). The combination of these factors created a fatal vulnerability.

The good news is that this old Vault was deployed 490 days ago and is rarely used now. Fusion’s official statement says that other vaults are fine, so there’s no need to panic. The official stance is also quite positive, indicating they will use DAO funds to compensate users for their losses. They are currently working with security firms like SEAL, Hexagate, and Blockaid to track the stolen funds. A technical review has also been released; those interested in the details of the vulnerability can check it out.

USDC-0.07%

ETH-10.43%

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

9 Likes

Reward
9
1
Repost
Share

Comment

0/400

GateUser-74b10196

· 01-07 03:03

Coming again? The Arbitrum ecosystem really has one problem after another. EIP-7702, this new thing, hasn't even been fully understood before being deployed. That's the real risk. 336,000 gone, it's really outrageous. Administrator privileges can be manipulated at will. Fuse's logic checks can even be bypassed, how careless is that? Still have to upgrade one by one. When can we finally feel at ease?

View OriginalReply0