What happened
On June 19, 2023, Ara Finance on BNB Smart Chain was exploited through an improperly authorized swap path. The attacker used a flash loan to abuse another address's token approvals, manipulate the thin ARA market, and retain about $125,000 after repaying the loan.
Technical root cause
Improper authorization of an allowance-consuming swap path. The contract did not bind token pulls to an authorized caller and bounded swap parameters, enabling use of another address's approvals. The resulting price manipulation amplified the loss.
How it happened
- The attacker took a 1.2 million-USDT DODO flash loan and called a swap contract that could spend a pre-approved wallet's ARA and USDT without correctly restricting the caller or transfer amounts.
- The unauthorized swap capability was used to move the ARA market, then sell ARA at the manipulated price, repay the flash loan, and retain the difference.
Protocol details
Classification
Access Control
Protocol Type
Reserve Currency
Affected asset / contract
ARA
Protocol links
Website
@AraBlocks
Attacker Address
0xf84efa8a9f7e68855cf17eaac9c2f97a9d131366
Exploit Transaction
0xd87cdecd5320301bf9…31cc3023b2
Evidence
Proof of concept
1 availableSources
- report Twitter/X Alert twitter.com
- report @Phalcon_xyz incident report twitter.com
- report @DeDotFiSecurity incident report twitter.com
- transaction BscScan exploit transaction bscscan.com
- analysis DeFiLlama defillama.com
- analysis QuillAudits: Ara Protocol Flash Loan Exploit quillaudits.com
- analysis OKLink June 2023 security incident digest foresightnews.pro
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
