A flaw in Goldfinch's legacy collectInterestRepayment() function permitted transfers from any approved address without proper safeguards. An attacker deposited USDC to manipulate share price, then repeatedly withdrew inflated amounts, draining the victim's holdings through the contract's misconfigured approval logic.

The on-chain private fund Goldfinch’s old contract on Ethereum (0x0689) contained a vulnerability. Because the user deltatiger.eth did not revoke the authorization in time, they were exploited and lost approximately USD 330,000. The attacker has already sent 118 ETH (around USD 329,000) into the privacy mixer Tornado Cash.