What happened
Bloom, a Blast perpetuals DEX built around rebasing USDB collateral, was exploited on May 9, 2024 through a margin-accounting bug. The protocol later reported $540K exploited and $486K recovered after a negotiated 10% bounty.
The flaw was stale yield-accounting state, not a token-level rebasing defect. The margin-update flow failed to consume or correctly checkpoint accrued yield when negative-PnL positions withdrew collateral, allowing duplicate withdrawal of the same yield entitlement.
How it happened
Bloom credited pending Blast-native yield to trading positions. During a cash deposit or withdrawal, updateTrade should have advanced the checkpoint used to calculate that yield. For negative-PnL positions, the checkpoint timestamp was not updated correctly.
An attacker could repeatedly use UpdateMargin to withdraw USDB-equivalent value for yield that had already been accounted for.
Protocol details
Funds Recovery
Recovered
$486K
Net Loss
$54,000
Evidence
- report Cyvers alert twitter.com
- report @De_FiSecurity incident report twitter.com
- report Bloom incident statement twitter.com
- report Bloom technical postmortem mirror.xyz
- report Bloom recovery report chaincatcher.com
- analysis DeFiLlama defillama.com
- analysis Quadriga Bloom incident archive quadrigainitiative.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
