Abracadabra Money Hack
What happened
Abracadabra Money lost about $6.5 million on Ethereum after a debt-accounting precision-loss flaw in legacy Cauldron V4 enabled unbacked MIM borrowing and a liquidity drain. The DAO recapitalized the shortfall from treasury; this was not an attacker-fund recovery.
Cauldron V4's debt accounting tracked an amount and debt parts that could be driven out of sync through precision loss. The solvency calculation relied on their ratio, allowing crafted borrow and repay operations to bypass the intended collateral constraint.
How it happened
The attacker flash-loaned MIM from DegenBox, donated and deposited it into BentoBox, then used repayForAll to create a mismatch between global debt amount and debt parts. Repeated borrow and repay operations made borrow parts disproportionately large, defeating the solvency calculation and enabling unbacked MIM borrowing.
The DAO set borrow limits to zero for affected cauldrons, stated collateral was not at risk, and used treasury reserves to fully collateralize the shortfall. There is no verified evidence that the attacker returned funds.
Protocol details
Evidence
- report @MIM_Spell incident report twitter.com
- report @peckshield incident report twitter.com
- report REKT: Abracadabra rekt.news
- report Abracadabra Money Exploit Analysis medium.com
- report CCData Stablecoins Report February 2024 uploads-ssl.webflow.com
- transaction Etherscan exploit transaction etherscan.io
- analysis Web Archive archive.ph
- analysis DeFiLlama defillama.com
- analysis Abracadabra DAO Incident Response paragraph.com
- analysis Abracadabra Cauldron V4 Exploit Analysis extropy-io.medium.com
- analysis Abracadabra Loss and MIM Destabilization cointelegraph.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
