Incident Overview
Alchemix's alETH contracts experienced a bug that allowed users to withdraw their ETH collateral with their alETH loans still outstanding, leading to a community rugpull of $6.5 million.
An issue with the deployment script of the alETH vault accidentally created additional vaults, which were used to incorrectly calculate outstanding debts. This led to protocol funds being used to pay off user debts. As a result, users were able to withdraw their ETH collateral with their alETH loans still outstanding.
The exploit was discovered and the mint contract for alETH was paused two and a half hours later. No users lost funds as a result of the exploit and Yearn.Finance, whose yield vaults automatically repay Alchemix’s synthetic loans, suffered no loss as well.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Alchemix, these are the critical security checks that could have prevented this incident (June 2021).
- Verify all logic paths related to Borrow Logic Exploit / Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Audit Report 1 Report
Sources & References
Learn to Prevent the Next Alchemix
The Alchemix hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.