Votemarket Incident Disclosure - 29-07-2026
Incident date: 29–30 July 2026 · Published: August 28, 2026 · Version: 1.0
This disclosure should be read together with the Legal Notice at the end of this document. The Association intends to update this disclosure if material new information becomes available; see Version history.
Summary
On July 29–30, 2026, a fabricated Ethereum block header was injected into the Votemarket Curve Oracle on Base, allowing forged storage proofs to be registered and the rewards of two campaigns to be withdrawn for a single epoch. Approximately $5,871 in campaign rewards was withdrawn (4,872.932664 USDC and 998.138291 frxUSD). Based on the Association's review to date, no defect has been identified in the core Votemarket contracts, no user deposits were affected, and no chain other than Base was affected.
Scope of impact. Based on the Association's review of live on-chain state as at August 14, 2026, and subject to the Legal Notice below: (i) the defect affected peripheral oracle infrastructure and not the core Votemarket contracts; (ii) no user deposit, lock or principal balance was affected; (iii) the loss was confined to the rewards of two campaigns for a single epoch on Base; and (iv) no equivalent unauthorised write has been identified on Arbitrum, Optimism or Polygon, or on any other Oracle operated by the Association. These statements reflect the information available to the Association as at the publication date.
The defect is the same one disclosed on March 12, 2026. The code fix issued in March was correct. The transaction intended to withdraw the superseded contract's authorisation on Base called a function for a permission that contract did not hold, and therefore did not take effect. The Association has since made voluntary, ex gratia payments to all identified affected voters, locker recipients and campaign managers, in amounts equal to the rewards a valid claim would have delivered; see "Reimbursement" below.
Details
The exploited contract, 0x2292514b78799486d860a5f685c3270bcef8e4b9, is an L1BlockOracleUpdater containing the identical sender-validation defect described in the March 12, 2026 disclosure: a conjunction in receiveMessage that short-circuits when the declared source chain is Ethereum mainnet, so the authorization check never reverts. Any address could deliver a cross-chain message that the contract accepted as authentic and wrote into the Oracle.
Severity of the defect: Critical (unauthorised write access to the block data against which all subsequent proofs are validated). Realised impact: limited — two campaigns, one epoch, approximately $5,871.
Affected Protocol: Votemarket V2 Curve Oracle on Base (peripheral oracle infrastructure)
Core Contracts Affected: No defect has been identified in the core Votemarket contracts. The platform contract released campaign rewards in response to proofs that were valid as against the oracle data it had been given; it did not operate contrary to its specification.
Background
Votemarket V2 verifies Curve GaugeController vote data from Ethereum on L2s using storage proofs. The L1BlockOracleUpdater writes L1 block data into the Oracle; the Verifier then validates proofs against the block header the Oracle holds. Whoever controls what block data enters the Oracle controls the state root every subsequent proof is checked against.
Root Cause Analysis
The vulnerability was identified and fixed in March. A corrected updater was written within four days, deployed, and authorized across the Oracles. The code fix was correct and is not implicated in this incident. What failed was retiring the old contract.
0x2292514b is deployed via CREATE3 and occupies the same address on Arbitrum, Base, Optimism and Polygon. Authorization is per-chain state and must be revoked on each chain separately.
On March 12, two transactions were executed from the governance multisig two and a half minutes apart, both targeting this contract on the Curve Oracle:
| Arbitrum | Base | |
|---|---|---|
| Executed (UTC) | 2026-03-12 13:50:59 | 2026-03-12 13:53:33 |
| Target | 0x2292514b… | 0x2292514b… |
| Function | revokeAuthorizedBlockNumberProvider | revokeAuthorizedDataProvider |
| Effect | Permission revoked | None |
| Transaction | 0xfc4dda1b… | 0xef1e8719… |
These two transactions are the primary evidence for the root cause stated above; both are linked so that a reader can verify them independently.
The contract held only the block-number-provider permission. The Base transaction revoked a permission it did not hold, and had no effect. Because revoking a permission that is not held is a valid operation, the transaction did not revert and was recorded as successfully executed; nothing distinguished it from a revocation that worked. No revocation transaction was executed on Optimism or Polygon.
At the time, the Association's change procedure did not require a post-execution read of on-chain state to confirm that a privileged permission change had in fact taken effect. That control has since been introduced; see "Remediation — Process and control changes".
On March 18 the corrected updater was authorized on the Base Curve Oracle. From that date the Oracle had two authorized providers: the corrected contract, which operated normally, and the vulnerable one, which had never been revoked. Weekly epoch insertion ran correctly for four months. The vulnerable contract was a redundant second write path to a system that was working, and nothing in normal operation revealed it.
The superseded contract accordingly retained write access for 140 days, from March 12 to July 30, 2026. The Association has identified no other transaction that used this write path during that period.
Attack Flow
At 23:30:35 UTC on July 29 the unidentified actor responsible (the "attacker") called sendMessage on LaPoste from Ethereum mainnet, addressed to the vulnerable updater on Base, carrying a fabricated block number (25,600,000), block hash and timestamp. The message was delivered at 23:45:49; because the declared source chain was Ethereum mainnet, the sender check short-circuited and the attacker's own address was accepted. The fabricated block was written into the Oracle for epoch 1785369600.
The timestamp was set exactly on the epoch boundary and the injection performed roughly an hour before the keeper writes each epoch. Since the Verifier rejects a re-registered epoch, the keeper could not subsequently write correct data.
At 23:55 the attacker registered a forged block header whose hash matched the fabricated one — a header with zeroed parent hash, coinbase and transaction roots, and an attacker-controlled state root — then registered a fabricated gauge weight and an inflated vote slope for their own address. At 00:01:31 and 00:01:33 on July 30 they claimed both campaigns, swapped the frxUSD to USDC, and forwarded the proceeds through two single-use addresses.
Detection and Containment
The Association became aware of the incident in the early morning of July 30, 2026 (UTC). The unauthorised write path on Base was closed at 07:37:39 UTC on July 30. Revocation followed on Optimism (July 30, 07:54:13 UTC) and Polygon (July 31, 13:52:14 UTC), and a full review of every Oracle on every chain was completed.
Timeline of Events (UTC)
| Time | Chain | Event | Transaction |
|---|---|---|---|
| Mar 12, 13:50:59 | Arbitrum | revokeAuthorizedBlockNumberProvider — effective | 0xfc4dda1b… |
| Mar 12, 13:53:33 | Base | revokeAuthorizedDataProvider — no effect; contract remains authorized | 0xef1e8719… |
| Mar 18, 15:58:39 | Base | Corrected updater authorized alongside it | 0x421080fa… |
| Jul 29, 23:30:35 | Ethereum | sendMessage to LaPoste targeting the vulnerable updater | 0xdf6c2204… |
| Jul 29, 23:45:49 | Base | Message delivered; sender check bypassed; Oracle poisoned | 0x7522e792… |
| Jul 29, 23:55:03 | Base | Forged block header registered | 0x00ecc3d8… |
| Jul 30, 00:01:31 | Base | claim() campaign 109 — 4,872.932664 USDC | 0x9b5466d5… |
| Jul 30, 00:01:33 | Base | claim() campaign 108 — 998.138291 frxUSD | 0x56f58cda… |
| Jul 30, 07:37:39 | Base | Vulnerable contract revoked — write path closed | 0x65ca4e89… |
| Jul 30, 07:54:13 | Optimism | Vulnerable contract revoked | 0xd35005da… |
| Jul 31, 13:52:14 | Polygon | Vulnerable contract revoked | 0x04a7abdb… |
| Jul 30 – Aug 3 | Base | Reimbursement executed; all 19 recipients paid |
Reimbursement
The Oracle holds a forged block header for epoch 1785369600, and the Verifier will not overwrite a registered epoch. That epoch can never be re-proven, so no legitimate participant could have claimed it on-chain, and no on-chain entitlement in respect of that epoch arose or survives. The payments described below were therefore made by direct transfer rather than through the protocol.
Entitlements were recomputed independently from Ethereum GaugeController state at the affected epoch — the amount a valid claim() would have delivered. The Association made nineteen payments between July 30 and August 3, 2026, all confirmed on-chain, totalling 4,876.443154 USDC and 999.727400 frxUSD (funded from Association resources), to every affected voter, locker recipient and campaign manager it identified, in an amount equal to that recomputed entitlement.
These payments were made voluntarily and ex gratia. They were made in the interest of user protection and to place affected participants in the position they would have occupied had the incident not occurred. They were not made in settlement or satisfaction of any claim, do not constitute an admission of liability, fault, wrongdoing or of any obligation to make such payments, and do not create any entitlement, precedent or expectation in respect of any future event. The Association reached this decision on the specific facts of this incident and reserves all rights.
Key Addresses
| Entity | Address |
|---|---|
| Attacker | 0x6fd1f8f35aa6A1f6CaD2CbB2C46316754d888888 |
| Vulnerable updater (revoked on all chains) | 0x2292514b78799486d860a5f685c3270bcef8e4b9 |
| Corrected updater | 0x56daFE265Ef903c6AA0Fe2a7F2a0518A0F8B73fe |
| Votemarket Curve Oracle (Base) | 0x36F5B50D70df3D3E1c7E1BAf06c32119408Ef7D8 |
| Verifier (Base) | 0x6095EBE7EbF2E0a912d6e293b00A6241a1A23dB3 |
| Votemarket platform (Base) | 0x8c2c5A295450DDFf4CB360cA73FCCC12243D14D9 |
| LaPoste | 0xF0000058000021003E4754dCA700C766DE7601C2 |
| Governance multisig (3 of 5) | 0xB0552b6860CE5C0202976Db056b5e3Cc4f9CC765 |
| Attacker fund consolidation | 0xBa3FE475f4617944c6e56D33CD7c2a841AaA8bCa |
Remediation
Containment and verification
- The vulnerable contract has been revoked on the Curve Oracle on Base, Optimism and Polygon.
- Every Oracle on every chain was then verified by reading live on-chain state — four chains, six Oracles, all three generations of updater contract. That review identified no contract carrying this defect holding write access on any chain or Oracle reviewed.
- Voluntary ex gratia payments have been made as described under "Reimbursement" above.
Process and control changes
- Every privileged permission change is now followed by a mandatory read of on-chain state confirming the resulting permission set, recorded against the transaction. A change is not treated as complete until that read is recorded.
- The Association maintains a per-chain register of authorised providers for every Oracle, reconciled against live on-chain state on a recurring basis.
- Deployments made through CREATE3, or otherwise sharing an address across chains, are handled under a per-chain checklist that treats each chain as a separate action with its own confirmation.
- Monitoring has been extended to alert on any write to Oracle block data originating from an address other than the designated keeper, and on any epoch registered outside the expected keeper schedule.
Product changes
- New campaigns are no longer offered on Base, Optimism and Polygon through the Stake DAO interface, and remaining campaigns on those chains are being wound down. Votemarket remains active on Arbitrum, where the March revocation took effect and has been confirmed against live on-chain state.
- Existing campaigns on Base, Optimism and Polygon will continue to be claimable until the end of each campaign's claim window (24 weeks after the campaign ends), and any rewards remaining unclaimed at that date will be dealt with in accordance with SDGP-76.
Reporting and recovery
The Association has notified the issuers of the affected assets and continues to monitor the addresses identified above. The Association reserves all rights and remedies against any person responsible for or benefiting from the unauthorised transactions described in this disclosure, and nothing in this disclosure limits those rights.
Contact
Security reports and questions relating to this disclosure: [email protected]. Vulnerability reports are handled under the Association's bug bounty programme.
Legal Notice
This disclosure is provided by the Stake DAO Association for transparency and informational purposes only. It does not constitute, and shall not be construed as, an offer, solicitation or invitation to purchase or sell any financial instrument or crypto-asset, nor a prospectus, crypto-asset white paper or marketing communication within the meaning of Regulation (EU) 2023/1114 ("MiCA") or any comparable regime. It reflects the Association's good-faith understanding of the incident based on information available as of the publication date and remains subject to revision as the investigation progresses; the Association assumes no obligation to update this disclosure except as required by applicable law. Nothing in this report constitutes an admission of liability, fault, or wrongdoing by the Association, its members, contributors, or service providers, and nothing herein waives any right, claim, or defense, all of which are expressly reserved. Without limitation, the payments described under "Reimbursement" were voluntary and ex gratia and are not to be construed as an admission of liability or as establishing any obligation or practice in respect of any future event. Statements regarding remediation and future processes are forward-looking, reflect current intentions, and are not guarantees; actual outcomes may differ. This document is not legal, financial, tax, or investment advice. Descriptions of the conduct of any unidentified third party are preliminary characterizations of on-chain activity, not findings of fact or legal conclusions. Certain information is derived from public blockchain data and third-party sources; the Association gives no warranty as to its accuracy or completeness. This disclosure is published in English; any translation is provided for convenience only and the English text prevails.
Version history
| Version | Date | Changes |
|---|---|---|
| 1.0 | August 28, 2026 | Initial publication |