Dough Finance Incident Analysis

On 12 July 2024 Dough Finance was exploited for approximately $2.1M after an attacker used flash loans and crafted paraswap calldata to trigger transferFrom calls in the ConnectorDeleverageParaswap deloop flow, draining WETH from multiple Dough DSA contracts; some funds were swapped and laundered via Tornado Cash while a white-hat returned a portion of ETH. The root cause is improper calldata validation in the call chain (deloopInOneOrMultipleTransactions → deloopAllCollaterals → flashloanVars.paraSwapContract.call), and the report includes addresses, transaction hashes, fund flows, and partial recoveries.