What happened
DefiPlaza is a DEX focused on capital efficiency, running on Ethereum and Radix. On 5 July 2024 at 13:15 UTC (block 20,240,539), one transaction drained every token from the DefiPlaza V2 pool on Ethereum, about $200,000 in total. The root cause was a rounding error in removeLiquidity: withdrawing more than 15/16ths of all LP tokens into a single token rounded a factor down to zero and removed that token's entire balance.
The original attacker, 0x14b362d2e38250604f21a334d71c13e2ed478467, broadcast the attack from the public mempool, and a front-running MEV bot run by Yoink copied it. Yoink paid a 62.5 ETH priority bribe to the Lido validator that built the block, kept about $24,000 in tokens, and returned those tokens to DefiPlaza within 30 minutes of being contacted. The team says it recovered about 10% of the funds. DefiPlaza then asked the Lido DAO to return the 62.5 ETH, and forum participants argued against doing so. DefiPlaza has no plan to restore liquidity on Ethereum. The Radix bridge was paused briefly and then reopened.
How it happened
- The transaction flash-borrowed about $129.6 million in ETH, USDC, USDT, WBTC, DAI, MKR and CRV from Balancer.
- It swapped the pool's other tokens until the pool's ratios matched its own holdings, then added all the tokens as liquidity, ending up with more than 94% of the LP tokens.
- It redeemed all of those LP tokens into ETH alone. Because the amount exceeded 15/16ths of the LP supply,
removeLiquidityrounded a factor to zero and paid out the pool's entire ETH balance. - With one token at zero balance, a state the contract never expected, tiny swaps drained the rest: 1 wei bought all the SPELL, 10^-18 SPELL bought all the YFI, and so on through every listed token.
- The transaction repaid the flash loans. Because an MEV bot front-ran the original attacker, most of the value went out as the 62.5 ETH validator bribe.
Protocol details
Security review history
- Pessimistic View report
Evidence
- report Decurity alert on the DefiPlaza hack x.com
- analysis DeFiLlama defillama.com
- analysis Post Mortem of DefiPlaza Ethereum exploit (Wayback copy) web.archive.org
- analysis DeFiHackLabs DeFiPlaza_exp.sol raw.githubusercontent.com
- analysis DefiPlaza exploit -- request for comment (Lido Research forum) research.lido.fi
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
