What happened
On October 23, 2021, Alpha Finance Lab disclosed that MEV sandwiching of Alpha Homora V2 liquidity-add transactions on Ethereum had affected 20 addresses. The team attributed the issue to an unchecked precondition in its Uniswap V2 Router02 integration, which could leave intended minimum-amount protections ineffective in certain states. Alpha reported 40.93 ETH extracted across the affected users.
Alpha Homora V2 did not enforce the Uniswap V2 Router02 precondition that desired amounts meet the corresponding minimums. In the affected state, the Router's asymmetric checks did not provide the intended slippage protection against transaction-ordering manipulation.
Case & protocol details
Attack Timeline
A bot privately bundled trades around an Alpha Homora V2 execute transaction. By changing the pool price before liquidity was added, it exploited the integration's failure to guarantee desired token amounts were at least the specified minima. The Router could then use more than the intended amount.
Alpha patched the integration and announced a compensation claim allocation; that claim program is not evidence that the extracted ETH was recovered.
Funds Recovery
Recovered
$171K
Net Loss
$0
Evidence & learning
Sources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.