Ethereum alarm clock Hack

Reported loss $260K
Ethereum
Other

What happened

In October 2022 at least 24 addresses exploited a gas-refund bug in Ethereum Alarm Clock, a years-old protocol for scheduling Ethereum transactions. When a scheduled transaction request was cancelled, the TransactionRequestCore contract refunded the caller's gas cost, but it overestimated that cost. Callers who cancelled requests with very high gas prices got back more ETH than they had spent.

PeckShield flagged the activity on 19 October 2022, and exploiters had collected about 204 ETH (about $260K). Because the profit rose with gas price, a large share went to block producers through MEV-Boost: reports said miners received about 51% of the gain. No public response from the project's developers was reported.

How it happened

  1. Ethereum Alarm Clock users schedule a future transaction by creating a request in TransactionRequestCore and depositing ETH to pay for its execution.
  2. The contract's cancel() function reimburses the caller for gas, computed as a gas-used figure (reports cite an 85,000 threshold) multiplied by the caller's gas price. This payout was larger than the fee the call actually cost.
  3. Exploiters called cancel() on requests with abnormally high gas prices, which scaled up the refund, and kept the difference between the refund and their real fee.
  4. The high gas prices paid block producers, who reportedly received about 51% of each gain through MEV-Boost. Exploiters kept about 204 ETH in total.

Protocol details

Classification Other / Protocol Logic
Protocol Type Exploit/Other
Implementation language Solidity

Evidence

Same attack technique

Browse all hacks →
Ethereum JUICE $216K lost Ethereum FloorDAO $65K lost Polygon LunaFI $36K lost Polkadot PolkaTrain $3.0M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes