HermesVault Smart Contract Vulnerability: $29.47K Reported Loss
HermesVault, an Algorand-based privacy protocol using zero-knowledge proofs for private transactions, was exploited.
- Reported loss
- $ 29,466
- Attack category
- Smart Contract Vulnerability
Incident Overview
The attacker exploited a flaw in the key reset defense logic within the withdrawal verification script. This allowed bypassing the zero-knowledge (zk) verification process and unauthorized withdrawal of funds. The protocol permanently shut down operations following the incident. Lead engineer Giulio Pizzini confirmed that the core zk circuit remained secure, but the auxiliary withdrawal script had a vulnerability. The team patched the issue, refunded a large portion of the funds, and initiated a full refund process for affected users.
Sources & References
This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.