Arcadia V2 Hack
Gross loss unconfirmed
Not disclosed
Unvalidated swap call targets
What happened
On July 15, 2025, an attacker exploited Arcadia Finance's Rebalancer on Base. CertiK estimated the attacker's net gain at about $3.6 million. Crafted swap instructions let the Rebalancer call into victim accounts and withdraw assets after debt repayment.
Technical root cause
Unvalidated swapData controlled actionTarget and router addresses. The Rebalancer's authorized call into Account.flashAction could therefore be redirected to a victim account.
How it happened
- The attacker created Arcadia accounts and borrowed assets through a Morpho flash loan.
- Crafted
swapDatasupplied unvalidated targets, re-enteringRebalancerSpotand directing its router call to a victim account. - After paying the victim's debt to satisfy health checks, the attacker used
flashAction()to transfer assets out, removed liquidity and repaid the loan. - CertiK traced approximately 1,203 ETH in proceeds bridged from Base to Ethereum and reported a 10% return bounty offer.
Protocol details
Classification
Protocol Logic / Reentrancy / Yield Aggregator
Protocol Type
Liquidity manager
Implementation language
Solidity
Protocol links
Website
@ArcadiaFi
Security review history
- Trust Security View report
- Pashov Audit Group View report
- Sherlock View report
Evidence
- report @ArcadiaFi incident report x.com
- report @hackenclub incident report x.com
- report @shoucccc incident report x.com
- analysis DeFiLlama defillama.com
- analysis Arcadia Incident Analysis certik.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
