← All Reports

WUSD Sybil Investigation: Airdrop Farming & Sybil Network Exposé

📅 2025-05-28

sybil airdrop-farming wusd multi-chain

WUSD.fi GLOVE Sybil Farming Attack - Onchain Investigation Report

Report Date: May 28, 2026

Event Type: Sybil Farming Attack

Loss Amount: ~$207,000 USD

Attack Time: May 25, 2026 06:07 UTC

Affected Chain: Ethereum Mainnet

Starting Block: 25,170,426

I. Executive Summary

On May 25, 2026, the WUSD.fi protocol suffered a meticulously planned Sybil farming attack. The attacker exploited a design flaw in the protocol's reward mechanism, using EIP-7702 technology to batch-create wallet addresses for farming GLOVE token rewards, ultimately stealing approximately $207,000 from Uniswap V3 liquidity pools.

Key Findings:

This is the first large-scale attack using EIP-7702, marking the maturation of a new attack technique
The core vulnerability lies in the lack of Sybil resistance mechanism in the WUSD._englove() function
The attacker converted funds to 98 ETH and transferred them to the Railgun privacy protocol to increase tracing difficulty
As of the report date, the WUSD.fi team has not issued any official statement

II. Event Overview

2.1 Project Background

| Project Information | Details |

|---------------------|---------|

| Project Name | WUSD.fi / GLOVE |

| Token Type | ERC-20 (WUSD, GLOVE) |

| Deployment Network | Ethereum Mainnet |

| Protocol Type | Stablecoin Wrapper Protocol + Incentive Reward System |

| GLOVE Utility | Protocol incentive token, distributed via wrap fee buybacks |

| Core Mechanism | WUSD._englove() + Glove.mintCreditless() |

GLOVE Token Economics:

WUSD protocol charges 1% fee on each wrap operation
Fee revenue is used to purchase GLOVE tokens on the open market
GLOVE is distributed as rewards to protocol participants
GLOVE has a "utility credit" system where users must accumulate internal credits to sell GLOVE holdings

2.2 Attacker Profile

| Attribute | Details |

|-----------|---------|

| Main EOA Address | 0x88329A09428778F62BC0C8BAac0997864E5a57f8 |

| GLO-USDC Pool Extraction Address | 0xB89F65D6c7d33A35Da7C01934e310a6f40E18A1f |

| GLO-USDT Pool Extraction Address | 0xa2Bd1A142ff49131B8CC70A332bdA0125018c324 |

| Operation Mode | Automated batch operations, EIP-7702 contract-driven |

| Current Fund Status | Converted to 98 ETH, deposited in Railgun |

III. Vulnerability Analysis

3.1 Vulnerability Mechanism: WUSD._englove() Design Flaw

Vulnerable Code Logic:

Condition 1: Wallet is a fresh wallet (new wallet)
Condition 2: wrap ≥ 100 WUSD
Condition 3: Holdings < 2 GLOVE
→ Can call Glove.mintCreditless() to receive 2 GLOVE

Triple Absence:

| Protection Measure | Status |

|-------------------|--------|

| Identity Check | ❌ Missing |

| Rate Limit | ❌ Missing |

| Sybil Detection | ❌ Missing |

Attack Viability:

Any new wallet address meeting the conditions can claim 2 GLOVE tokens
Attackers can farm rewards infinitely by batch-creating addresses
The contract code logic is completely correct, but the economic incentive design has fundamental flaws

3.2 Deep Analysis of EIP-7702 Attack Mechanism

What is EIP-7702:

EIP-7702 is a new feature introduced in the Ethereum Pectra upgrade, allowing Externally Owned Accounts (EOAs) to temporarily delegate execution rights to smart contracts, enabling regular wallets to operate as contracts.

Key Role in the Attack:

Traditional Method: Each new wallet address creation requires:
                   1. Generate private key
                   2. Deploy wallet contract (or use EOA)
                   3. Fund transfer
                   4. Contract call
                   → High cost and low efficiency per operation

EIP-7702 Method:
                   1. Deploy single helper contract
                   2. Batch-delegate multiple EOA addresses via EIP-7702
                   3. Automated execution of all operations within the contract
                   → Significantly reduces batch operation costs, enabling scalable attacks

Technical Breakthrough:

The attacker only needed to deploy one EIP-7702 helper contract
This contract could delegate unlimited EOA addresses to execute smart contract logic
Each delegated address appeared as a "fresh wallet" to the protocol
Achieved single contract, multiple addresses, large-scale Sybil farming attack

EIP-7702 Security Warning:

This is another case of EIP-7702 being used for malicious purposes since the Pectra upgrade in May 2025. Phishing attacks had previously exploited this technology, resulting in $1.54M in losses.

IV. Attack Path Reconstruction

4.1 Complete Attack Flowchart

┌─────────────────────────────────────────────────────────────────────┐ │ MORPHO USDT FLASH LOAN │ │ ($100,000+ USDT) │ └──────────────────────────────┬──────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────────────┐ │ Deploy EIP-7702 Helper Contract │ │ Contract address temporarily gains │ │ smart contract execution capability │ └──────────────────────────────┬──────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────────────┐ │ Batch Create Fresh Wallet Cluster │ │ (Hundreds to thousands of new addresses) │ └──────────────────────────────┬──────────────────────────────────────┘ │ ┌────────────────┼────────────────┐ ▼ ▼ ▼ ┌──────────┐ ┌──────────┐ ┌──────────┐ │Wallet #1 │ │Wallet #2 │ │Wallet #N │ │ wrap 100 │ │ wrap 100 │ │ wrap 100 │ │ WUSD │ │ WUSD │ │ WUSD │ └────┬─────┘ └────┬─────┘ └────┬─────┘ │ │ │ ▼ ▼ ▼ ┌─────────────────────────────────────────┐ │ Call Glove.mintCreditless() │ │ Each address claims 2 GLOVE │ └─────────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────┐ │ Batch Dump GLOVE to │ │ Uniswap V3 Liquidity Pools │ │ (GLO-USDC Pool + GLO-USDT Pool) │ └─────────────────────────────────────────┘ │ ┌────────────────┼────────────────┐ ▼ ▼ ▼ ┌──────────┐ ┌──────────┐ ┌──────────┐ │-11,702 │ │ -8,079 │ │ Profit │ │ USDC │ │ USDT │ │ Aggregation └──────────┘ └──────────┘ └────┬─────┘ │ ▼ ┌─────────────────┐ │ Repay Morpho │ │ Flash Loan │ └─────────────────┘ │ ▼ ┌─────────────────┐ │ Convert to ETH│ │ (~98 ETH) │ └─────────────────┘ │ ▼ ┌─────────────────┐ │ Railgun │ │ (Privacy) │ └─────────────────┘

4.2 Detailed Timeline

| Time (UTC) | Block Height | Event Description |

|------------|--------------|-------------------|

| 06:07:59 | 25,170,426 | Attacker initiates first Morpho USDT flash loan |

| 06:08-06:15 | ~25,170,426- | EIP-7702 contract deployment, batch wallet creation |

| 06:08-06:15 | ~25,170,426- | Loop wrap/unwrap operations, mass mintCreditless calls |

| 06:08-06:15 | ~25,170,426- | GLOVE tokens batch minted and sold |

| 06:08-06:15 | ~25,170,426- | GLO-USDC pool loses 11,702 USDC |

| 06:08-06:15 | ~25,170,426- | GLO-USDT pool loses 8,079 USDT |

| 06:15 | ~ | Repay Morpho flash loan principal + interest |

| 06:15 | ~ | Profit aggregation to attacker main address |

| 06:15 | ~ | Converted to ~98 ETH |

| 06:54:52 | ~ | ExVul security researcher first public warning |

| 08:38:05 | ~ | PeckShield confirms attack, publishes complete analysis |

| 08:38+ | ~ | 98 ETH transferred to Railgun privacy protocol |

4.3 Fund Flow Tracking

Initial Fund Source:

| Source | Amount | Nature |

|--------|--------|--------|

| Morpho USDT Flash Loan | $100,000+ | Flash loan (repaid within single transaction) |

| Attacker Own Funds | Small amount of ETH | Initial Gas fees |

Lost Asset Details:

|-------|--------|-------------|-------------------|

| Total | ~19,781.24 | Stablecoin Value | - |

Fund Aggregation and Mixing:

GLO-USDC Pool Extraction Address ─┐ ├──▶ Attacker Main EOA ──▶ Convert to 98 ETH ──▶ Railgun GLO-USDT Pool Extraction Address ─┘

Railgun Transfer Records:

Amount: ~98 ETH (worth approximately $207,000)
Time: Shortly after PeckShield confirmation
Purpose: Anonymize transactions via zero-knowledge proofs, sever chain tracking

V. Sybil Wallet Network Analysis

5.1 Attack Scale Estimation

Based on attack revenue and single reward (2 GLOVE) estimation:

Total Loss ≈ $207,000 Single Wrap Fee ≈ 1% × 100 WUSD = 1 WUSD ≈ $1 Per Cycle Cost ≈ gas fees + wrap fee Per Cycle Revenue ≈ 2 GLOVE × GLOVE price Conservative estimate: Hundreds to thousands of Fresh Wallet addresses involved

5.2 Wallet Cluster Characteristics

| Characteristic | Description |

|---------------|-------------|

| Address Type | EIP-7702 Delegated EOA |

| Creation Time | Within attack window (~06:07-06:15 UTC) |

| Lifecycle | Single-use (abandoned after attack) |

| GLOVE Holdings | All sold after attack |

| Correlation | Shared same EIP-7702 helper contract |

5.3 EIP-7702 Contract Address

Based on public onchain analysis, the attacker's deployed EIP-7702 helper contract:

Function: Batch management of delegated EOA addresses
Permissions: Temporarily obtained EOA execution rights
Status: Possibly abandoned or destroyed after attack

VI. Flash Loan Path Analysis

6.1 Morpho USDT Flash Loan Mechanism

Morpho Protocol Features:

Optimization lending market based on Aave V3
Supports flash loans, no collateral required
Atomic transaction guarantee

Flash Loan Workflow:

1. Attack contract borrows USDT from Morpho ↓ Execute attack operations within the same transaction - wrap WUSD - mintCreditless - swap GLOVE for stablecoins ↓ Repay USDT principal + fees ↓ Transaction succeeds, profit goes to attacker OR Transaction fails/rolls back, Morpho funds untouched

6.2 Complete Attack-Repayment Path

| Step | Operation | Amount |

|------|-----------|--------|

| 1 | Borrow Morpho USDT | +$100,000+ |

| 2 | wrap WUSD (loop N times) | -$N WUSD |

| 3 | mintCreditless (loop N times) | +2N GLOVE |

| 4 | swap GLOVE → USDC/USDT | Sell all GLOVE |

| 5 | Extract liquidity from GLO pools | +$207,000 |

| 6 | Repay Morpho USDT + fee | -$100,000+ |

| 7 | Net profit aggregation | +$207,000-$100,000 |

VII. GLOVE Token Economic Impact

7.1 Immediate Market Impact

| Impact Dimension | Description |

|------------------|-------------|

| Price Impact | GLOVE token price pressured by massive selling |

| Liquidity Impact | GLO-USDC and GLO-USDT pool liquidity significantly decreased |

| LP Loss | Liquidity provider positions damaged by impermanent loss + pool draining |

| Protocol Trust | Reward mechanism vulnerability exposed, protocol credibility damaged |

7.2 Long-term Token Economics Impact

| Item | Assessment |

|------|------------|

| GLOVE Token Price | Faces selling pressure short-term, depends on protocol fix long-term |

| Protocol TVL | Liquidity providers may withdraw funds |

| Incentive Mechanism | Requires redesign with Sybil resistance |

| Community Trust | WUSD.fi non-responsive as of report date affects trust recovery |

7.3 Industry Trend Correlation

2026 DeFi Security Landscape:

As of report date, DeFi exploit cumulative losses: ~$770M+
May became a high-incident period for liquidity layer attacks
Incentive paths and internal accounting becoming new attack vectors
Traditional code audits cannot cover economic incentive design flaws

VIII. Security Warnings and Recommendations

8.1 Vulnerability Root Cause Summary

| Dimension | Issue |

|-----------|-------|

| Code Level | Contract logic correct, no typical vulnerabilities |

| Design Level | WUSD._englove() lacks Sybil resistance |

| Economic Level | mintCreditless has no frequency limit/identity verification |

| Audit Level | Routine audits don't test economic incentive paths |

8.2 Protocol Security Recommendations

Immediate Actions:

Pause Glove.mintCreditless() functionality

Implement wallet history correlation detection

Add per-address claim frequency limits

Introduce onchain identity verification (e.g., WorldID)

Long-term Improvements:

Economic incentive design requires special audits

Introduce TWAP price oracle to prevent flash loan manipulation

Establish real-time anomaly monitoring and alerting system

Consider decentralized emergency pause mechanism

8.3 User Risk Warnings

| Risk Type | Description |

|-----------|-------------|

| LP Risk | Liquidity providers in attacked pools lost assets |

| Exposure Risk | Users holding GLOVE tokens face selling pressure |

| Trust Risk | Protocol non-response may indicate Rug Pull |

| Recovery Risk | Funds have entered Railgun, recovery extremely unlikely |

IX. Evidence Sources

9.1 Onchain Data Sources

| Source | Link/Notes |

|--------|------------|

| Etherscan | API Key: 2WASDAKWI6H5S1HJNS4V4RYZNBHW2QUCFA |

| PeckShield Alert | https://twitter.com/PeckShieldAlert |

| ExVul Research | https://twitter.com/ExVul_ |

| Lookonchain | https://m.lookonchain.com/feeds/57616 |

9.2 Security Company Confirmations

| Company | Status | Source |

|---------|--------|--------|

| ExVul | First public warning | X/Twitter |

| PeckShield | Confirmed and tracking | X/Twitter Alert |

| SlowMist | Added to hack database | Hack Archives |

9.3 News Sources

| Source | Link |

|--------|------|

| Live Bitcoin News | https://www.livebitcoinnews.com/wusd-fi-sybil-farming-attack-drains-200k-from-glove-pools/ |

| CoinAlert News | https://coinalertnews.com/news/2026/05/27/defi-exploits-glove-stakedao |

| CoinFi | https://www.coinfi.com/news/1812793/wusdfi-sybil-farming-attack-drains-200k-from-glove-pools |

| Crypto Adventure | https://coinstats.app/news/21f76ad1f0bcf1a49e26ef5b33f5a896986db9aaaef63be7d0f8ca08f952adc1_WUSDGLOVE-Exploit-Drains-207K-Before-Funds-Move-Into-Railgun |

| OurCryptoTalk | https://ourcryptotalk.com/news/glove-exploit-wusd-fi-200k-sybil-attack |

X. Appendices

Appendix A: Key Address Summary

| Address Purpose | Address |

|-----------------|---------|

| Attacker Main EOA | 0x88329A09428778F62BC0C8BAac0997864E5a57f8 |

| GLO-USDC Pool Extraction | 0xB89F65D6c7d33A35Da7C01934e310a6f40E18A1f |

| GLO-USDT Pool Extraction | 0xa2Bd1A142ff49131B8CC70A332bdA0125018c324 |

| Target Contract | 0x068e3563b1c19590f822c0e13445c4fa1b9eefa5 |

Appendix B: Attack Statistics

| Metric | Value |

|--------|-------|

| Attack Duration | ~8 minutes |

| Attack Block Range | 25,170,426+ |

| GLO-USDC Pool Loss | 11,702.083968 USDC |

| GLO-USDT Pool Loss | 8,079.161526 USDT |

| Total Stablecoin Loss | ~19,781.24 |

| ETH Equivalent | ~98 ETH |

| Final Loss | ~$207,000 |

Disclaimer: This report is based on publicly available on-chain data and third-party sources for informational purposes only. The analysis and recommendations in this report should not be construed as legal or investment advice.

Report Generation Date: May 28, 2026