# AlpsCon AI Trade Hub: Hardhat default key + migrate reward over-claim drains pools

AlpsCon reward hub whitelisted the public Hardhat default account; attacker used EIP-7702 delegation with its known key plus migrate() reward double-counting to drain ~152.8K USDC.

- Payout: Real-world hack
- Severity: high
- Program: AlpsCon
- Disclosed: 2026-10-18
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-10/AlpsCon_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20261018-alpscon
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:chained technique:default-creds technique:source-review vuln:access-control vuln:business-logic vuln:flash-loan

**Target:** BNB Chain reward hub contracts (V6-V9) with onlyVerified whitelist and migrate()/claimServiceResults()
**Root cause:** The onlyVerified whitelist trusted the canonical Hardhat account 0xf39F...2266 whose private key is public, and each hub version's migrate() imports prior balances then claimServiceResults() pays them against accumulated profitPerShare while the new deposit's entryProfitPerShare is zero.
**Steps:**
1. Sign an EIP-7702 authorization for 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266 using public key 0xac0974...f2ff80, delegating it to exploit code
2. Flash-borrow 1,027,990 USDC from Aave V3
3. Swap USDC->ALPS via router 0x7227...1721
4. Approve and call HUB_V6.purchaseServiceCredits(alpsIn) as the delegated Hardhat account
5. Call HUB_V6.migrate() then HUB_V9.claimServiceResults() to over-claim accumulated rewards
6. Call HUB_V6.withdrawFunds(STAKED_ALPS), swap ALPS->USDC, repay Aave loan
**How found:** Recognized the canonical Hardhat default account on the onlyVerified whitelist and its public private key, then analyzed versioned hub migrate()/claimServiceResults() accounting to spot that imported balances are paid against accumulated profitPerShare with zero entryProfitPerShare.
**Exploitation:** Attacker flash-borrowed 1,027,990 USDC, bought ALPS, staked into still-open V6 hub passing the whitelist via EIP-7702 delegation of the public-key Hardhat account, migrated the fresh stake forward so claimServiceResults() paid the full historical profitPerShare, over-claimed V7/V8/V9 rewards, unstaked, sold ALPS back, repaid loan for 152,295.3625 USDC net.
**Escalation:** Chained whitelist bypass (public key + EIP-7702) with cross-version migrate() reward accounting bug to amplify a single fresh deposit into full historical reward payout across V7/V8/V9.
**Insight:** Check whitelists/allowlists for well-known test keys (Hardhat/Anvil account #0) and combine with EIP-7702 delegation to impersonate privileged EOAs; also audit versioned migrate() flows for reward accounting that pays imported balances against pre-existing profitPerShare.