A hacker attack on the DeFi protocol SIR.trading raises crucial questions about the security of the new transient storage feature, introduced by the Dencun hard fork on the Ethereum network.
Summary
DeFi hacker attack on SIR.trading: $355,000 in TVL stolen
The DeFi protocol SIR.trading (Synthetics Implemented Right) was hit on March 30 by a sophisticated exploit that led to the theft of the entire Total Value Locked (TVL), amounting to 355,000 dollars.
The security team TenArmorAlert detected the attack, confirming that the hacker exploited a vulnerability in the smart contracts connected to the new transient storage mode introduced on Ethereum with the Dencun update. Decurity, another company specializing in blockchain auditing and security, also publicly raised the alert, facilitating a rapid awareness among the DeFi community.
Xatarrer, founder of the protocol, confirmed the incident on X (formerly Twitter), calling it “the worst news a protocol can receive.” Despite the severity of the event, the team expressed the intention to try to continue the project, even though they have to rebuild user trust from scratch.
How the exploit works: the vulnerability in the callback function
According to Decurity, the exploit affected a smart contract named Vault, which used transient storage to optimize gas costs. The vulnerable contract contained a callback function that the hacker managed to manipulate, replacing the original Uniswap pool address with one controlled by the attacker.
The uniswapV3SwapCallback function, commonly used to handle automated trades, was invoked multiple times with modified parameters, allowing the attacker to redirect the funds contained in the vault to their own wallet. The lack of security checks on the authenticity of the Uniswap pool made the abuse possible.
This type of attack falls into the category of logical exploits, which do not depend on obvious bugs in the code, but on design errors in the interaction between multiple contracts.
Ethereum Dencun and the emerging risks of transient storage
Thehard fork Dencun, activated on the Ethereum mainnet in March 2024, introduced new features to improve scalability, including transient storage. This allows for temporary on-chain data writing with lower gas consumption, but also involves new attack surfaces.
According to the researcher SupLabsYi of Supremacy, this attack represents one of the first direct exploits related to the new architecture:
“It is not just an error in the callback function, but a wake-up call on the very use of transient storage.”
The problem, according to several analysts, is that transient storage does not retain data between transactions, but it can be accessible within a single transaction execution, opening unpredictable scenarios if poorly implemented.
The hacker’s wallet and anonymity with Railgun
The stolen funds were transferred to a wallet powered through Railgun, an Ethereum protocol focused on privacy. The founder has already contacted the Railgun team to try to trace the funds, but the chances of recovery remain low, also due to the privacy-preserving nature of the protocol.
SIR.trading: from “safe” leverage to complete collapse
The SIR.trading project positioned itself as a DeFi platform for secure leverage trading, promising mechanisms to reduce the risks of liquidation and volatility. However, a disclaimer in the official documents warned of the possibility of bugs and exploits, even after technical audits:
“Undiscovered bugs or exploits in SIR smart contracts could lead to losses.”
The promise of a safer leverage was tragically disproven by an attack that brought the entire protocol to its knees.
Implications for DeFi and Ethereum
The exploit at SIR.trading has crucial implications:
• Highlight the limitations of smart contract audits in detecting vulnerabilities related to innovative functionalities.
• Raises doubts about the maturity of transient storage as a secure tool.
• The debate on the necessity of stricter security standards for emerging DeFi protocols is renewed.
The case of SIR.trading is reminiscent of previous episodes such as Euler Finance or BadgerDAO, where sophisticated exploits also hit projects considered solid. Unlike these, however, SIR.trading was still in its early stages, making the reputational and operational impact even more difficult to overcome.
Conclusions: a wake-up call for the entire Ethereum ecosystem
The attack on SIR.trading is a warning for developers, investors, and users:
Every innovation — like transient storage — can hide critical vulnerabilities if not thoroughly tested.
For those building in DeFi, a new culture of security is needed. For investors, the golden rule always applies: never bet more than you are willing to lose.