What happened
Bunni V2 lost approximately $8.4 million on September 2, 2025, affecting Ethereum's USDC/USDT pool and Unichain's weETH/ETH pool. Repeated tiny withdrawals distorted liquidity calculations and made a sequence of swaps profitable. Bunni's September 4 post-mortem reported reopening withdrawals while deposits and swaps stayed paused.
BunniHubLogic::withdraw() rounded the idle-balance reduction down. Repetition created an excessive liquidity underestimate that could reverse during a swap. Replacing mulDiv with mulDivUp stopped this exploit in Bunni's tests; its post-mortem did not claim the change ruled out every other attack.
How it happened
- Flash-borrowed USDT funded swaps that reduced the Ethereum pool's active USDC balance to 28 wei.
- Forty-four tiny withdrawals amplified rounding errors, reducing that balance to 4 wei and calculated liquidity by 84.4%.
- A large swap changed which token balance determined the liquidity estimate, abruptly increasing calculated liquidity.
- A reverse swap captured that distortion as profit. The same strategy affected the Unichain pool.
Protocol details
Security review history
- Trail of Bits View report
- Cyfrin View report
Evidence
- report @CertiKAlert incident report x.com
- report @bunni_xyz incident report x.com
- analysis Website reference coinmarketcap.com
- analysis DeFiLlama defillama.com
- analysis Exploit Post Mortem blog.bunni.xyz
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
