Incident Overview
On June 17, 2025, Meta Pool on the Ethereum network suffered a loss of approximately $400,000 due to a vulnerability in the minting logic of its mpETH pool. The attack also involved MEV frontrunner Yoink, who replicated and executed the exploit immediately after the original attacker.
The exploit originated from Meta Pool’s failure to override or restrict the inherited mint() function from OpenZeppelin’s ERC4626Upgradeable standard. This public, non-payable function allowed users to mint mpETH without actually providing ETH, violating the protocol’s 1:1 backing invariant. The attacker first used a flash loan to drain the liquidUnstakePool of available mpETH, ensuring that the internal swap logic would be bypassed.
They then invoked mint() to mint over 9700 mpETH for free and swapped part of it for ETH, securing a profit of roughly 56.35 ETH (~$142K). An MEV bot named Yoink also front-ran the exploit, taking a share of the proceeds. Meta Pool has since disabled mpETH transfers and committed to ongoing communication and governance updates.
Exploit txs:
https://etherscan.io/tx/0x4f43fc6d…c86ef9
https://etherscan.io/tx/0x57ee419a…d1fa69
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to MetaPool, these are the critical security checks that could have prevented this incident (June 2025).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next MetaPool
The MetaPool hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.