# Hedgey Finance: cancelCampaign leaves approval, drains 48M USDC

Hedgey Finance's cancelCampaign failed to revoke token approval, letting attacker create and cancel a campaign to drain 48M USDC.

- Payout: Real-world hack
- Severity: critical
- Program: HedgeyFinance
- Analysis by: DeFiHackLabs
- Disclosed: 2024-04-19
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-04/HedgeyFinance_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240419-hedgeyfinance
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** IClaimCampaigns contract on Ethereum
**Root cause:** cancelCampaign did not reset the token allowance granted to the contract during createLockedCampaign, leaving the contract approved to spend the manager's tokens.
**Steps:**
1. Flash loan 1,305,000 USDC from Balancer.
2. Approve HedgeyFinance contract to spend the loaned USDC.
3. Call `createLockedCampaign` with a campaign using the loaned USDC and a dummy root.
4. Call `cancelCampaign` with the same campaign ID; the contract refunds the tokens but does not revoke the approval.
5. Call `USDC.transferFrom(HedgeyFinance, attacker, balance)` to drain all USDC held by the contract.
6. Repay the flash loan.
**How found:** Likely identified that cancelCampaign did not clear the allowance set during campaign creation, enabling a drain of all tokens approved to the contract.
**Exploitation:** Attacker used a Balancer flash loan to obtain 1.305M USDC, approved the Hedgey contract, created a locked campaign, then canceled it. The cancellation refunded the tokens but left the approval intact, allowing the attacker to pull the entire USDC balance from the contract via transferFrom.
**Insight:** When a contract holds user funds via approval, check if cancellation/refund paths properly revoke allowances; leftover approvals can be abused to drain all approved balances.