Arcadia V1 Hack

What happened

On July 10, 2023, Arcadia Finance's lending protocol was exploited on Ethereum and Optimism for a reported total of $459,030.44. The attacker flash-borrowed WETH and USDC, opened vaults, borrowed from the liquidity pools through Arcadia's optimistic action flow, and reentered liquidation after withdrawing the vault assets. Arcadia paused pool-related contracts and set interest to zero while it prepared a fix.

How it happened

1. The attacker took flash loans of 2.4 WETH and 20,672 USDC, then created and funded vaults on the affected networks.
2. Using doActionWithLeverage(), they borrowed liquidity and deposited it into the vault, subject to a health check only after the action sequence.
3. During vaultManagementAction(), the attacker withdrew the vault assets to the multi-call flow and reentered through liquidateVault() while the vault held no assets but still had debt.
4. Liquidation removed the debt; the final health check then saw a vault with zero assets and zero debt, allowing the attacker to retain the withdrawn funds and repay the flash loans.

Protocol details

Classification Ecosystem / Access Control / Exchange (DEX)

Protocol Type Leveraged Farming

Affected asset / contract ARCADIA

Protocol links Website @ArcadiaFi

Security review history

• Solidity Finance View report
• Nethermind Security View report

Evidence

• report @PeckShieldAlert incident report twitter.com
• report @ArcadiaFi incident report twitter.com
• report @ArcadiaFi incident report twitter.com
• analysis Post Mortem arcadiafinance.medium.com
• analysis Website reference cointelegraph.com
• analysis DeFiLlama defillama.com
• analysis ArcadiaFi Hack Analysis blog.solidityscan.com

Understand the attack patterns

Compare incidents →

Access Control Attacks Flash Loan Attacks Reentrancy