What happened
Alchemix's alETH contracts experienced a bug that allowed users to withdraw their ETH collateral with their alETH loans still outstanding, leading to a community rugpull of $6.5 million.
An issue with the deployment script of the alETH vault accidentally created additional vaults, which were used to incorrectly calculate outstanding debts. This led to protocol funds being used to pay off user debts. As a result, users were able to withdraw their ETH collateral with their alETH loans still outstanding.
The exploit was discovered and the mint contract for alETH was paused two and a half hours later. No users lost funds as a result of the exploit and Yearn.Finance, whose yield vaults automatically repay Alchemix’s synthetic loans, suffered no loss as well.
Case & protocol details
Security review history
- Runtime Verification Report
Evidence & learning
Sources and on-chain records
- report Report forum.alchemix.fi
- analysis Website reference twitter.com
- analysis Website reference twitter.com
- analysis Website reference cointelegraph.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.