What happened
Exactly Protocol's August 18, 2023 DebtManager exploit affected 117 accounts, with losses of $7,612,038 in the team's final accounting. Existing token allowances exposed leveraged users to unauthorized withdrawals.
Technical root cause
Unvalidated market inputs and permit handling allowed reentrant operations under another user's identity.
How it happened
- The attacker supplied a malicious market and the victim's account to
leverage, bypassing the permit check. - A callback reentered
crossDeleveragewhile DebtManager still acted for the victim. - Victim assets were routed into an attacker-controlled swap pool and extracted. A separate share-accounting flaw enabled further liquidations.
- Exactly paused most operations; withdrawals remained available. Its Strategies section returned on September 26 after ABDK audited DebtManager.
Protocol details
Classification
Protocol Logic / Access Control / Borrowing and Lending
Protocol Type
Lending
Affected asset / contract
EXA
Implementation language
Solidity
Protocol links
Website
@ExactlyProtocol
Security review history
- Coinspect View report
- Quantstamp View report
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
