Abracadabra Money Hack

What happened

On November 8, 2022, a searcher exploited a stale xSUSHI price cache in Abracadabra's Cauldron lending system. The transaction borrowed against collateral at the old exchange rate, updated the rate after xSUSHI had declined, then self-liquidated. EigenPhi and SlowMist's reconstruction calculates a 110,911 MIM profit.

How it happened

1. The attacker flash-borrowed 450,000 xSUSHI from SushiSwap BentoBox.
2. They deposited xSUSHI as collateral in Abracadabra's xSUSHI Cauldron and borrowed MIM using the cached exchange rate.
3. They updated the exchange rate after the collateral price had fallen, then liquidated their own position at the new rate.
4. They withdrew the recovered collateral and MIM, repaid the flash loan, and retained 110,911 MIM.

Protocol details

Classification Exchange (DEX) / Stablecoin / Borrowing and Lending

Protocol Type Exploit/Oracle Issue

Affected asset / contract MIM

Protocol links Website @MIM_Spell

Evidence

• report Report coindesk.com
• report @spreekaway incident report twitter.com
• analysis Casting a Magic Spell on Abracadabra eigenphi.substack.com
• analysis Abracadabra's MIM Stablecoin Used by DeFi Attackers, Here's How u.today

Understand the attack patterns

Compare incidents →

Oracle Manipulation & Price Manipulation