What happened
On October 4, 2025, an attacker exploited legacy Abracadabra Cauldron V4 contracts on Ethereum, using a two-action cook() call to bypass the final solvency check and borrow unbacked MIM. About $1.7 million was taken and converted to ETH.
Unsafe overwrite of shared security-critical state in a batched execution flow. An extensibility hook returned a default status struct that erased the previously set needsSolvencyCheck flag. Deprecated Cauldron V4 contracts remained active, making the flaw exploitable.
Case & protocol details
Attack Timeline
cook() batches actions while carrying a status flag that determines whether a solvency check runs at the end. Borrow action 5 set that flag, but a following undefined action 0 replaced the shared status with a default value. The flag became false, so the transaction completed without verifying that the new borrow was collateralized.
Evidence & learning
Attack pattern
Compare incidents →Proof of concept
1 availableSources and on-chain records
- report Report x.com
- report Post-mortem rekt.news
- transaction Transaction etherscan.io
- analysis Website reference x.com
- analysis Website reference x.com
- analysis Website reference onesafe.io
- analysis Verichains: Abracadabra Money Hack Analysis blog.verichains.io
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.