Post-mortem IPOR USDC optimizer Arbitrum vault exploit

IPOR Fusion Vault Exploit Analysis — Legacy Vault IPOR USDC Optimizer Arbitrum — EIP-7702 Vulnerability and Missing Fuse Validation

Update: resolved. The incident is closed. About $336K was taken from the legacy vault IPOR USDC Lending Optimizer Arbitrum on 6 January 2026. The next day the attacker returned 92 ETH and kept the agreed 10% bounty, which the IPOR DAO covered, so the vault received back 336,580 USDC, 100% of what was taken. No depositor lost funds. The transactions are listed in the Resolution section below.

1. Root Cause: The incident resulted from the combination of two independent factors: a logical error in the legacy Vault contract (missing validation) and the misuse of an account delegation mechanism (EIP-7702) by an administrator account. Those conditions were only met in this legacy vault.

• Vault Error (Logic Error): The function handling instantWithdraw lacked validation for “fuses” (logic modules), on setup fuses address (configureInstantWithdrawalFuses). The contract trusted that any added “fuse” was safe, because there is a restriction that only trusted addresses can call this function, which has been checked. This allowed for the execution of arbitrary logic within the Vault’s context, provided the attacker could add their own “fuse.” https://arbiscan.io/tx/0x238b4e619158432ff5ceb279cfea38007d048af4f59901c7af2efcf32e9671b6
• Privilege Compromise via EIP-7702: The administrator account (0xd8a1…) held permissions to manage the Vault (e.g., adding fuses). This EOA (Externally Owned Account) used the EIP-7702 mechanism to delegate its execution to an implementation contract (0xa3cc…).
• Vulnerability in Delegated Contract (Gadget): The contract 0xa3cc…, to which the admin delegated permissions, contained a function allowing for an “arbitrary call.” This is visible in the provided screenshot at line 208:

This line allowed the attacker (or a specific actor aware of the vector) to call any function on any address on behalf of the administrator.

2. Execution Flow:

1. Initiation: The attacker noticed that the admin address (0xd8a1…) was delegating its behavior to a vulnerable contract (0xa3cc…) via EIP-7702.
2. Identity Hijacking: Using line 208 in the vulnerable contract, the attacker forced the admin account to call a function in the IPOR Fusion Vault contract. From the Vault’s perspective, the transaction originated from the legitimate Administrator.
3. Injecting a Malicious Fuse: Using the admin privileges, the attacker added a new, malicious “fuse” to the Vault’s configuration. This was possible because the system recognized it as a legitimate administrative operation.
4. Fund Exfiltration: The attacker then triggered instantWithdraw. Due to the missing fuse validation in this function configureInstantWithdrawalFuses, the Vault executed the code of the malicious fuse.
5. Drain: The malicious fuse transferred assets (tokens) from the Vault to the attacker’s address.

3. Why only this vault was vulnerable:

This attack required a “perfect storm” of errors that do not occur together for any other vault:

• Lack of Strict Fuse Validation: In newer versions of vaults, fuse validation is explicitly enforced when setting the instantWithdraw queue. This check ensures that only verified logic is allowed in the withdrawal process, preventing the execution of arbitrary code even if an attacker bypasses other checks. The affected vault was a legacy vault deployed 490 days ago. All vaults deployed after that initial batch of vaults have the validation enforced.

Compromised Contract Isolation: The contract — vulnerable EIP-7702 delegate was used erroneously for this legacy vault. It was used to bundle multiple transactions together to increase the efficiency of the rewards compounding. Alpha for exactly 2 vaults was relying on this contract. Out of those one was lacking strict fuse validation. This contract was not part of the Fusion but rather an additional utility build for Alpha.

4. Resolution:

All times UTC, all transactions on Arbitrum. The vault is 0xa91267a25939b2b0f046013fbf9597008f7f014b.

• 6 January 2026, 21:02, exploit: the vault’s positions (269,217 aUSDC and 65,754 of a second USDC position, about $336K) were moved to the attacker’s address 0x9b1bd925a752cca6a28a27ec1058cf06b6434cee. Transaction
• 7 January 2026, 13:01, funds returned: the attacker sent 92 ETH back to an IPOR multisig and kept the agreed 10% bounty. Transaction
• 7 January 2026, conversion: the 92 ETH were swapped to 294,883 USDC. Transaction
• 7 January 2026, bounty covered by the IPOR DAO: the IPOR DAO account added 39,699 USDC, covering the bounty and the ETH price difference. Transaction
• 7 January 2026, 17:01, vault restored: 336,580 USDC (as Aave aUSDC) went back into the vault, 100% of what was taken. No depositor lost funds. Transaction
• Status: the incident is resolved. The vulnerable EIP-7702 delegate was an Alpha utility, not part of IPOR Fusion, and the missing fuse validation existed only in that legacy vault; vaults deployed after the initial batch enforce it.