What happened
Abracadabra Money lost about $6.5 million on Ethereum after a debt-accounting precision-loss flaw in legacy Cauldron V4 enabled unbacked MIM borrowing and a liquidity drain. The DAO recapitalized the shortfall from treasury; this was not an attacker-fund recovery.
Cauldron V4's debt accounting tracked an amount and debt parts that could be driven out of sync through precision loss. The solvency calculation relied on their ratio, allowing crafted borrow and repay operations to bypass the intended collateral constraint.
Case & protocol details
Attack Timeline
The attacker flash-loaned MIM from DegenBox, donated and deposited it into BentoBox, then used repayForAll to create a mismatch between global debt amount and debt parts. Repeated borrow and repay operations made borrow parts disproportionately large, defeating the solvency calculation and enabling unbacked MIM borrowing.
The DAO set borrow limits to zero for affected cauldrons, stated collateral was not at risk, and used treasury reserves to fully collateralize the shortfall. There is no verified evidence that the attacker returned funds.
Evidence & learning
Sources and on-chain records
- report Report twitter.com
- report Post-mortem medium.com
- report CCData Stablecoins Report February 2024 uploads-ssl.webflow.com
- analysis Abracadabra DAO Incident Response paragraph.com
- analysis Abracadabra Cauldron V4 Exploit Analysis extropy-io.medium.com
- analysis Abracadabra Loss and MIM Destabilization cointelegraph.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.