TheRedVillage exploit analysis

The Red Village runs its backend as a registry of services. A router contract resolves a service name to a proxy address and forwards a caller-supplied payload to it. forwardRequest(serviceName, serviceId, data) on PolygonTRVRouter carries no check on who is calling, so the relay is open to anyone. The router itself holds the _authorizeUpgrade role on the service proxies, and those proxies in turn hold the token-moving roles on TRVZooKeeper, the vault that custodies player WETH under standing approvals. Those three facts are the whole attack.

The sequence was short. The DeFiHackLabs entry and its proof of concept reconstruct it against a fork of Polygon:

1. The attacker called forwardRequest on the router naming the season service, with a payload encoding upgradeTo(address) and an implementation the attacker had deployed.
2. The UUPS proxy checked its caller and found the router, which holds _authorizeUpgrade, so the upgrade was authorised.
3. A second transaction ran the attacker's implementation through the upgraded proxy. It called TRVZooKeeper.transferERC20In once per player who had a standing approval, pulling each one's WETH into the vault, then called transferERC20Out to send the vault's entire balance to the attacker.

DeFiHackLabs records the upgrade in 0xac0666c534dcad575cdb1fbcbe5b74e8bba418e35f4273933f62167d5143d55d at block 94,200,341 and the drain in 0x3730141adea0cd5a64824c0a541c4405256b4054ac54d8c1de65fe6ba210dd35 at block 94,200,868, about thirteen minutes apart. In the setup trace it is a contract the attacker deployed, holding no privilege of its own, that calls forwardRequest and has the payload forwarded straight through. The only role check anywhere on the path sits inside the proxy's upgradeTo, and it tests the router.

PolygonScan records the drain transaction as successful, calling into the season service proxy at 0xb172E15974FEAAe221EbC0860B578Dd7B6B06b77. It contains 300 ERC-20 transfers: WETH moving from individual player addresses into the vault at 0x426d27190A2DdB87f1C6235F710e159a0A3774D4, one pull per player, followed by the sweep out. The largest single pull is 9.9736245 WETH and the next is 5.646407105892860026.

DeFiHackLabs records a loss of 31.426018474517367982 WETH, about $80.7K. It splits into 31.350379502001368 WETH taken from 299 players with standing approvals and the 0.075638972516 WETH the vault already held, which the sweep took with it.

What was wrong was not a key or a signer. The attacker is a plain externally owned account and no admin credential appears anywhere in the path. The upgrade authority was seized because the only role check on the route belonged to the router rather than to the caller, and the payload that mattered most was an upgrade. A gate on forwardRequest would have closed it. So would granting transferERC20In and transferERC20Out to something other than a proxy whose code anyone able to reach the router can replace.

That arrangement, privilege parked on a component meant to be an intermediary, with an ungated way in, runs through several other incidents in this corpus. A permissionless swap entry point used router allowances to pull tokens belonging to other users in RouterDrain, and a solver function with no access control drained victim allowances in EtherFiAtomicQueue. ReflexerGEB registered a shared proxy-actions library as a safe owner. In The Red Village the intermediary was the router, and what it held was the right to replace the code that moved the money.