What happened
On 25 June 2026, an attacker exploited Ocean Protocol BPool clones on Polygon and extracted approximately $11.9K in mOCEAN after repaying flash liquidity.
Technical root cause
The single-sided join and exit accounting paths were asymmetric under SideStaking participation, allowing a caller to redeem more base token than the paired join funded.
How it happened
The attacker flash-borrowed mOCEAN, repeatedly entered and exited SideStaking-controlled pools, then retained the excess mOCEAN produced by the non-neutral accounting cycle.
Protocol details
Classification
Protocol Logic
Protocol Type
DeFi Protocol
Implementation language
Solidity
Protocol links
Website
@oceanprotocol
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
