Trình tối ưu hóa Fusion trên Arbitrum bị tấn công quyền hạn EIP-7702, mất 336.000 USDC

【Chain Article】Arbitrum ecosystem faced another issue. The USDC Optimizer Vault launched by Fusion was attacked on January 6, losing $336,000.

The root cause is quite typical — the old version of the Vault code failed to properly validate the “fuse” logic, creating an opportunity for hackers. What’s more aggressive is that the attacker used an EIP-7702 trick, leveraging this mechanism to directly manipulate admin permissions, then injected malicious logic modules, and finally transferred the funds to Tornado.Cash.

From a technical perspective, this incident is actually a combination of two vulnerabilities: one is a logical defect in the contract itself, and the other is weak permission management caused by insufficient understanding of new Ethereum features (EIP-7702). Together, these became a critical vulnerability.

The good news is that this old Vault was deployed 490 days ago and is rarely used now. Fusion’s official statement says other vaults are fine, so there’s no need to panic. The official attitude is also reasonable, stating they will use DAO treasury to compensate users for losses. They are currently tracking the funds with security firms like SEAL, Hexagate, and Blockaid. A technical postmortem has also been released for those who want to dive deeper into vulnerability details.