# Renegade dark pool: uninitialized proxy hijacked to drain funds

Uninitialized Renegade dark pool proxy on Arbitrum let attacker call initialize to set malicious logic, then delegatecall drained ~$209K across 26 tokens.

- Payout: Real-world hack
- Severity: critical
- Program: Renegade
- Credited: DeFiHackLabs
- Disclosed: 2026-05-10
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/Renegade_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260510-renegade
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:misconfiguration

**Target:** Arbitrum dark pool proxy (Stylus implementation)
**Root cause:** The dark pool proxy contract was left uninitialized, so anyone could call initialize() and set attacker-controlled implementation/logic addresses in proxy storage.
**Steps:**
1. Call `initialize(address(this), 0,0,0,0,0,0,0,0,0, 0, publicBlinder, attacker)` on proxy `0x30bD8eAb...` to store attacker logic
2. Call `updateWallet("","","","")` which delegatecalls the injected logic from proxy storage context
3. Injected logic runs `drainTokens()` iterating 26 tokens and transferring full balances to attacker
4. Transfer drained tokens to exploiter EOA
**Exploitation:** Attacker initialized the uninitialized proxy with their own contract as logic, then triggered updateWallet which delegatecalled the injected drainTokens, sweeping all 26 token balances held by the proxy (~$209K, 104,383 USDC plus other tokens) to the attacker.
**Insight:** Check whether upgradeable/proxy contracts on Arbitrum Stylus were ever initialized; an uninitialized proxy lets anyone set implementation and gain delegatecall over its token balances.