Ara Finance Hack
What happened
On June 19, 2023, Ara Finance on BNB Smart Chain was exploited through an improperly authorized swap path. The attacker used a flash loan to abuse another address's token approvals, manipulate the thin ARA market, and retain about $125,000 after repaying the loan.
Improper authorization of an allowance-consuming swap path. The contract did not bind token pulls to an authorized caller and bounded swap parameters, enabling use of another address's approvals. The resulting price manipulation amplified the loss.
Case & protocol details
How it happened
The attacker took a 1.2 million-USDT DODO flash loan and called a swap contract that could spend a pre-approved wallet's ARA and USDT without correctly restricting the caller or transfer amounts. The unauthorized swap capability was used to move the ARA market, then sell ARA at the manipulated price, repay the flash loan, and retain the difference.
Evidence & learning
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
