What happened
On December 1, 2024, an attacker exploited Clipper's single-asset deposit/withdrawal feature on two liquidity pools across Base and Optimism. The loss was reported as about $450,000, roughly 6% of Clipper's TVL. Clipper said the issue was a withdrawal-function vulnerability rather than a private-key leak, disabled single-token withdrawals, and paused swaps and deposits while tracing the funds.
How it happened
- The attacker targeted low-liquidity pools that supported depositing or withdrawing one token instead of the normal basket of pool assets.
- After obtaining a server signature for a deposit/withdrawal, the attacker executed state-changing swaps before finalizing the transaction.
- That intervening balance change let the attacker exploit the single-asset flow's pricing/validation assumptions and extract funds from the pools.
Protocol details
Security review history
- Quantstamp View report
- Solidified View report
Evidence
- report @Clipper_DEX incident report x.com
- analysis DeFiLlama defillama.com
- analysis Clipper DEX says recent $450K hack wasn’t caused by private key leak cointelegraph.com
- analysis Crypto Hacks: Three Crypto Protocols Exploited in The First Week of December 2024 audita.io
- analysis Clipper DEX suffers $450,000 hack m.web3isgoinggreat.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
