# GiddyVaultV3: incomplete EIP-712 signature coverage drains gauge tokens

GiddyVaultV3 signed only keccak256(SwapInfo.data), letting attacker swap fromToken/toToken/amount/aggregator and drain strategy gauge tokens worth ~$1.3M.

- Payout: Real-world hack
- Severity: critical
- Program: GiddyVaultV3
- Credited: DeFiHackLabs
- Disclosed: 2026-04-23
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-04/giddyvaultv3_compound_auth_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260423-giddyvaultv3-compound-auth
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:signature-replay

**Target:** EIP-712 compound authorization in Giddy vault/strategy contracts
**Root cause:** VaultAuth signature digest commits only to keccak256 of each SwapInfo.data blob, not to fromToken, toToken, amount, or aggregator fields, so those fields are attacker-mutable under a valid signature.
**Steps:**
1. Obtain any valid signed VaultAuth for a vault (nonce, deadline, amount, data hashes).
2. Craft compoundSwaps with fromToken=gauge, toToken=attacker helper, amount=uint256.max, aggregator=attacker helper, data=abi.encodeCall(AttackHelper.fakeSwap,()).
3. Reuse the original signature since only keccak256(data) is covered.
4. Call `IGiddyVaultV3(vault).compound(auth)`; strategy approves attacker helper for uint256.max.
5. Helper pulls gauge tokens (g(yb-tBTC), g(yb-cbBTC), g(yb-WBTC)) to attacker EOA.
6. Repeat for each vault/strategy pair.
**Exploitation:** Attacker reused valid signed compound authorizations while substituting swap fields to point at an attacker helper contract; each compound call caused the strategy to approve the helper for uint256.max, which then transferred the strategy-held YieldBasis gauge tokens to the attacker across three vaults (~$1.3M).
**Escalation:** Same signature-coverage flaw replicated across tBTC, cbBTC, and WBTC V2 vaults to drain all three strategies.
**Insight:** When auditing EIP-712 structs, verify the typehash and structHash encode every field the calldata uses; if only a nested bytes blob's hash is signed, all sibling fields (token addresses, amounts, target/aggregator) are attacker-controlled and can redirect approvals.