Adri
@adrianromero
Followers
1K
Following
1K
Media
37
Statuses
794
independent security researcher | resident auditor @electisec (prev @yAuditDAO) | top warden @code4rena
See my work →
Joined April 2009
Funds were successfully rescued, the issue has been patched and contracts are now secure. Special thanks to @cove_fi, @1inch, @seal_911 and @devops199fan in particular for their exemplary professionalism throughout this entire process.
0
1
10
The response was incredible. Shortly after reported, a warroom was assembled with top security researchers. Suddenly I went from solo bug hunting to running whitehat ops with people I admire. A surreal and amazing experience.
1
0
6
This wasn't just theoretical - it was an unconditioned and fully executable attack that could have been performed atomically to drain all rewards. While the COVE token is currently locked, this attack could have disrupted its future launch or forced a complete token replacement.
1
0
4
Here's the attack flow:. 1) Attacker registers malicious hook + target hook.2) Calls removeAllPlugins().3) During execution, malicious hook reenters to call removePlugin().4) This causes double-removal, breaking accounting and minting rewards from thin air.
1
0
5
In particular, @cove_fi used the FarmingPlugin contract to distribute incentives for their new CoveUSD protocol. The implementation of farmed() uses an integer type to offset the user's rewards. By shifting this negatively it would be possible to fake an invalid distribution.
1
0
5
This issue would allow an attacker to register a malicious hook alongside the target hook and, depending on the particular implementation, execute the attack while the bad hook is being called in removeAllPlugins().
2
0
4
Note how the balance variable is stored locally in line 135 and then hooks are iterated to notify the change using this cached value.
1
0
7
Hooks are permissionless and can be freely configured by end users. While there were some guards in place to protect against potential malicious hooks, the removeAllPlugins() had a reentrancy vector that could allow an attacker to gain control while state is being modified.
1
0
5
This design provides a generic solution to different use cases that depend on token balances, such as rewards (farming plugin or governance voting (delegation plugin .
1
0
5
The token-hooks ( contracts developed by @1inch are in essence an ERC20 implementation that notifies hooks on balance changes.
Security researcher @adrianromero recently found a potential security issue in 1inch smart contract code deployed by @cove_fi. The affected version was never deployed within 1inch’s own infrastructure. Patching began immediately & is now complete. No user funds were ever at.
1
0
5
A critical vulnerability I found in code forked from @1inch could have drained ~650k COVE tokens from @cove_fi contracts. Here's how the attack worked and how it was responsibly disclosed 🧵.
On June 12, 2025, a critical reentrancy vulnerability was identified by @adrianromero @yAuditDAO @electisec in Cove’s liquidity mining program and promptly neutralized. No user funds were lost, and 652,565 non-transferable COVE tokens were secured as a precaution. The.
9
18
195
RT @cove_fi: On June 12, 2025, a critical reentrancy vulnerability was identified by @adrianromero @yAuditDAO @electisec in Cove’s liquidit….
0
8
0
If you think finding an issue in a bug bounty is hard, trust me, getting a fair payment for it is much more difficult.
2
1
30
RT @electisec: New security report is out! 🥷. You think @OlympusDAO is cool? Well, it got cooler 😎. We reviewed Olympus Cooler V2, a lendin….
0
2
0
RT @electisec: Just dropped a new report 📝. This one covers @origami_fi's hOHM, a cross-chain solution built on top of @OlympusDAO’s Cooler….
0
5
0
RT @twynexyz: Audits are necessary, but not all are equal. Twyne got audited by @electisec (prev. yAudit). The only team to find critical i….
0
4
0
RT @electisec: ⚡Electisec has shaped many security gigabrains… but we're not done!. We're soon kicking off our Smart Contract fellowship to….
0
17
0
RT @electisec: New audit report is live! 🔍. We've been securing @vfat_io since 2023, and we're excited to continue this partnership. Bugs….
0
5
0
RT @electisec: ⚠️ Attention @Uniswap V4 Integratoors ⚠️. Creating and managing liquidity positions that involve native ETH on Uni V4? Read….
0
32
0