What happened
On May 26, 2025, Dexodus Finance, a perpetuals exchange on Base, lost about $291,000 to $300,000 when an attacker replayed an old Chainlink price report into its leveraged trading module.
Dexodus accepted signed Chainlink price reports passed in through performUpkeep(). Its verification checked that a report was validly signed but did not check its timestamp, nonce or any other freshness data. A report from about a month earlier was therefore still accepted. The attacker used an old report pricing ETH at about $1,816 to open a 100x leveraged long, then closed it in the same transaction at the current price of about $2,520. The profit came out of the Dexodus liquidity pool.
QuillAudits reports that the proceeds were bridged to Ethereum through Stargate, with about 107 ETH later sent to a team-controlled multisig and the rest deposited on Binance. Dexodus said it was working with security teams on recovery and would refund affected users.
Exploit transaction: 0x6ffb494293fc5c32c5a6ab7dc3fff1fcc6e90fba9a6d6e486ba0a15ce518147e
Attacker: 0x863d3b920a6d98d5689d2cb8bb0d61e90a91e0dc
How it happened
- The attacker flash-borrowed about $10,500 from the Balancer vault.
- They called
performUpkeep()with a validly signed but roughly month-old Chainlink report that priced ETH at about $1,816. Dexodus checked the signature but not the report's age, so it accepted the price. - At that price they opened a 100x long with about $10,000 of collateral, a position of about $1,000,000.
- In the same transaction they submitted a current report (ETH about $2,520) and closed the position, taking about $300,000 in profit from the liquidity pool.
- They repaid the flash loan and kept the profit.
Protocol details
Evidence
- report @hklst4r incident report x.com
- report Post-mortem medium.com
- report @TenArmorAlert incident report x.com
- transaction basescan.org transaction 0x6ffb…147e basescan.org
- analysis DeFiLlama defillama.com
- analysis Dexodus Finance Hack Analysis blog.solidityscan.com
- analysis Dexodus Finance lost $300K in a signature replay attack quillaudits.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
