Alpha Finance Lab Hack

What happened

On October 23, 2021, Alpha Finance Lab disclosed that MEV sandwiching of Alpha Homora V2 liquidity-add transactions on Ethereum had affected 20 addresses. The team attributed the issue to an unchecked precondition in its Uniswap V2 Router02 integration, which could leave intended minimum-amount protections ineffective in certain states. Alpha reported 40.93 ETH extracted across the affected users.

Technical root cause

Alpha Homora V2 did not enforce the Uniswap V2 Router02 precondition that desired amounts meet the corresponding minimums. In the affected state, the Router's asymmetric checks did not provide the intended slippage protection against transaction-ordering manipulation.

How it happened

1. A bot privately bundled trades around an Alpha Homora V2 execute transaction.
2. By changing the pool price before liquidity was added, it exploited the integration's failure to guarantee desired token amounts were at least the specified minima.
3. The Router could then use more than the intended amount.
4. Alpha patched the integration and announced a compensation claim allocation; that claim program is not evidence that the extracted ETH was recovered.

Protocol details

Classification Transaction-ordering manipulation

Protocol Type Exploit/Other

Affected asset / contract ALPHA

Implementation language Solidity

Protocol links Website @alphafinancelab

Funds Recovery

100.0%

Recovered

$171K

Net Loss

$0

Evidence

• report Report blog.alphafinance.io
• analysis DeFiLlama defillama.com
• analysis Alpha Venture DAO: MEV Bots and Uniswap Implicit Assumptions blog.alphaventuredao.io
• analysis GoPlus: Alpha Homora MEV Bot Analysis goplussecurity.medium.com
• analysis Academic survey of sandwich attacks fileserver-az.core.ac.uk

Understand the attack patterns

Compare incidents →

Oracle Manipulation & Price Manipulation