What happened
Citadel Finance, a treasury-backed protocol on Arbitrum, was exploited on January 27, 2024 for about 43 ETH (roughly $93K-$97K). Its CITRedeem contract let holders redeem CIT for treasury assets and priced the redemption with Camelot's getAmountsOut on the WETH/USDC pair, which is a live spot price. Using a flash loan, the attacker pushed that pool's price far out of line, redeemed a small amount of CIT for much more WETH than it was worth, reversed the swap and repaid the loan. The attacker repeated the attack in more than one transaction.
**Block data**
- Attacker:
0xfcf88e5e1314ca3b6be7eed851568834233f8b49 - Attack contract:
0xfcbf411237ac830dc892edec054f15ba7f9ea5a6 - Vulnerable contract (CITRedeem):
0x34b666992fcce34669940ab6b017fe11e5750799 - Exploit txs:
0xf52a681bc76df1e3a61d9266e3a66c7388ef579d62373feb4fd0991d36006855,0x89eafbcd3ce44285c00fae61dc4202dc2d63965ba20bce33ed92e417a23349a2
How it happened
- The attacker deposited CIT into Citadel's staking contract so it held a position that could be redeemed.
- It flash-borrowed 4,500 WETH from a Uniswap V3 WETH/USDC pool.
- It swapped the WETH for USDC through the Camelot router, heavily skewing the Camelot WETH/USDC price.
- It called
redeemonCITRedeem. Because the contract valued the redemption withgetAmountsOuton the manipulated Camelot pair, a small amount of CIT paid out far too much WETH from the treasury. - It swapped the USDC back to WETH, repaid the flash loan and kept the difference. The attack was repeated for a total of about 43 ETH.
Protocol details
Classification
Other / Access Control
Protocol Type
Exploit/Flash Loan Attack
Affected asset / contract
CIT
Implementation language
Solidity
Protocol links
Website
@Citadel_Finance
Evidence
- report @Citadel_Finance incident report twitter.com
- transaction arbiscan.io transaction 0x36bc…5725 arbiscan.io
- transaction arbiscan.io transaction 0x62a0…1176 arbiscan.io
- transaction arbiscan.io transaction 0x89ea…49a2 arbiscan.io
- transaction arbiscan.io transaction 0xbc98…c145 arbiscan.io
- transaction arbiscan.io transaction 0xf52a…6855 arbiscan.io
- address arbiscan.io address 0xfCBf…A5A6 arbiscan.io
- address arbiscan.io address 0xfCf8…8b49 arbiscan.io
- analysis Web Archive archive.is
- analysis DeFiLlama defillama.com
- analysis DeFiHackLabs CitadelFinance_exp.sol (2024-01 PoC) raw.githubusercontent.com
- analysis DeFiHackLabs 2024 incident list (20240127 CitadelFinance - Price Manipulation) raw.githubusercontent.com
- analysis How Was Citadel Finance Exploited? (Neptune Mutual) neptunemutual.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
