What happened
On September 26, 2024, a vulnerability in Bedrock's uniBTC smart contract allowed an exploiter to mint 30.8 uniBTC and swap it for WBTC in Uniswap pools. Bedrock's postmortem says approximately $2 million in liquidity, primarily in the Uniswap pool, was affected. The team paused the vulnerable contracts and said reserve assets remained secure after the fix.
How it happened
- The SigmaSupplier contract did not register the native-BTC token representation on non-native BTC chains.
- Its total-supply lookup therefore returned zero for that token instead of reflecting the value transferred with the call.
- The vault's cap restriction passed, allowing uniBTC to be minted using native tokens where that minting should have been disallowed.
- The exploiter minted 30.8 uniBTC on Ethereum and swapped it for WBTC from Uniswap liquidity.
- Bedrock paused the vulnerable contracts and deployed a fix.
Protocol details
Classification
Protocol Logic / Minting Error
Protocol Type
Exploit/Other
Implementation language
Solidity
Protocol links
Website
@Bedrock_DeFi
Evidence
- report @BeosinAlert incident report x.com
- report Report cointelegraph.com
- report @phtevenstrong incident report x.com
- report Post Mortem Report paragraph.com
- analysis DeFiLlama defillama.com
- analysis Bedrock vulnerability disclosure and actions dedaub.com
- analysis Bedrock DeFi incident analysis blog.verichains.io
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
