Abracadabra Spell Hack

Reported loss $1.7M
Ethereum
Solvency-check bypass in cook() batching flow

What happened

On October 4, 2025, an attacker exploited legacy Abracadabra Cauldron V4 contracts on Ethereum, using a two-action cook() call to bypass the final solvency check and borrow unbacked MIM. About $1.7 million was taken and converted to ETH.

Technical root cause

Unsafe overwrite of shared security-critical state in a batched execution flow. An extensibility hook returned a default status struct that erased the previously set needsSolvencyCheck flag. Deprecated Cauldron V4 contracts remained active, making the flaw exploitable.

How it happened

cook() batches actions while carrying a status flag that determines whether a solvency check runs at the end. Borrow action 5 set that flag, but a following undefined action 0 replaced the shared status with a default value. The flag became false, so the transaction completed without verifying that the new borrow was collateralized.

Protocol details

Classification Protocol Logic
Protocol Type CDP
Implementation language Solidity
Protocol links Website @MIM_Spell
Attacker Address 0x1AaaDe3e9062d124B7DeB0eD6DDC7055EFA7354d
Exploit Transaction 0x842aae91c89a9e5043…3f99a9e5e6

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Access Control Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes