# Cork Protocol: access control flaw drains 12M via fake asset

Cork Protocol access-control flaw let attacker register a malicious swap asset and hook, draining ~12M USD of wstETH via crafted PoolManager swaps.

- Payout: Real-world hack
- Severity: critical
- Program: Corkprotocol
- Credited: DeFiHackLabs
- Disclosed: 2025-05-28
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-05/Corkprotocol_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250528-corkprotocol
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:access-control vuln:business-logic

**Target:** CorkConfig / CorkHook / ERC1967Proxy swap-asset registration and AMM hook
**Root cause:** CorkConfig.initializeModuleCore and issueNewDs lacked proper authorization, letting an attacker register an arbitrary swap asset and attacker-controlled hook, then manipulate CorkHook reserves and PoolManager swaps to mint/redeem at skewed rates.
**Steps:**
1. Fork mainnet at block 22581020-1; attacker 0xEA6f...da98 approves wstETH and LiquidityToken to attack contract.
2. Transfer LiquidityToken balance to ERC1967Proxy and wstETH to attack contract.
3. Call getDeployedSwapAssets on ERC1967Proxy2 to obtain ct2/ds2 pair for wstETH.
4. Swap wstETH->ct2 via CorkHook.swap with minOut = rB*9999/10000.
5. depositPsm into ERC1967Proxy with fixed id to obtain PSM position.
6. Call CorkConfig.initializeModuleCore(wstETH, ds2, 1, 100, address(this)) to register attacker as module core.
7. Compute id via getId and call issueNewDs(id, block.timestamp*10) to create new DS.
8. depositLv half of ds2 balance, then PoolManager.unlock with encoded (ds2, ct3, id, ds3).
9. In unlockCallback, sync ct3, craft PoolKey with attacker hook, call beforeSwap->CorkHook.beforeSwap, transfer ct3 to PoolManager, settleFor(CorkHook), then reverse swap with amountSpecified=r.
10. Call returnRaWithCtDs to redeem, then withdraw wstETH to attacker.
**Exploitation:** Attacker registered themselves as module core via initializeModuleCore, issued a new DS, and used a malicious hook in PoolManager swaps to manipulate CorkHook reserves and settleFor flows, redeeming inflated ct/ds positions for wstETH and extracting ~12M USD.
**Escalation:** Chained asset registration, DS issuance, depositPsm/depositLv, and PoolManager hook callbacks into a single atomic transaction to amplify drain.
**Insight:** When a protocol exposes initializeModuleCore/issueNewDs without access control, an attacker can register themselves as a module and inject a malicious hook into the AMM; audit registration and hook-callback authorization paths, not just swap math.