Fun.xyz CheckoutPool exploit analysis

A single Polygon transaction took USDC out of a CheckoutPool contract by calling a superseded bridge operator contract that anyone could reach. Defimon Alerts identifies the pool as Fun.xyz's CheckoutPool and calls the operator a Bridge Operator Contract, or BOC. The "old BOC" in the DeFiHackLabs heading is an earlier version of that contract, at 0x13046f513802De93f3fC48f0cDb2Cb7df22Ec01A.

The call chain

The pool pays out through a CheckoutPaymaster, which lets approved operators call activateAndCall to run CheckoutPool.execute(). The old BOC was still on the paymaster's operator list (isOperatorAllowed returns true for it), and the proof of concept shows it had _ALLOW_ALL_ set to true with no effective operator gate on bridge(). Defimon describes the same gap as a missing onlyOperator modifier. The contracts' source is unverified on Polygonscan, so the mechanism rests on the reproduction's interfaces and assertions rather than on published code.

The attack is one call. The attacker called bridge() on the old BOC with target set to the paymaster and callData encoding activateAndCall(CheckoutPool, execute(depositAddress, ops)). The deposit address was the attacker's own contract, and ops held one ERC-4337 user operation whose hash matched the userOpHash stored for that deposit's checkout. Because the old BOC counted as an allowed operator, the paymaster forwarded the call, and execute() paid the checkout's stored targetAmount in USDC to the attacker's smart account.

That checkout's targetAmount was larger than its heldAmount, the USDC actually deposited against it. execute() covered the difference from the pool's surplus, tracked in _POOL_EXCESS_. The PoC asserts both effects: the pool's USDC balance falls by the full target amount, and _POOL_EXCESS_ falls by the target minus the held amount.

The figures

DeFiHackLabs records a loss of 85,730 USDC, measured as the USDC the attacker's smart account received, which the PoC checks equals the pool's balance drop. Polygonscan shows one transfer of 85,730 USDC.e, the bridged USDC token at 0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174, from the pool at 0x1929347E025D4F5F8D6B2Bd2261e2f4EfcAcd215 to 0xB648db3bD2f7646D648570CF5765495D46011Ae1. The explorer timestamps it at 23:20:07 UTC on 16 March 2026, in block 84,291,587. Defimon Alerts dates the incident 17 March, reports the loss as $85,720, and lists $3,947 as rescued in a thread of its own rescues.

Revoking the old BOC's operator status on CheckoutPaymaster when it was superseded, or an operator check on its bridge(), would have closed the path.