Peapods Finance Hack
Reported loss
$207K
Oracle manipulation in user-created Pods
What happened
On July 8, 2025, Peapods Finance suffered an oracle-price manipulation that led to an unauthorized withdrawal of roughly $200,000 in ETH. Reporting and a Peapods core-team comment identified low-liquidity Uniswap pools used as TWAP price inputs for two user-created Pod markets as the affected dependency.
How it happened
- The attacker targeted user-created Pods whose TWAP oracle inputs came from Uniswap pools with deteriorated liquidity.
- By skewing those pool prices, the attacker caused the oracle to report false values.
- The manipulated valuation was then used to borrow or liquidate positions and drain funds.
Protocol details
Classification
Ecosystem / Yield Aggregator / Oracle Manipulation
Protocol Type
Yield
Implementation language
Solidity
Protocol links
Website
@PeapodsFinance
Security review history
- SourceHat View report
Evidence
- report @peckshield incident report x.com
- report @CertiKAlert incident report x.com
- report @officer_cia incident report x.com
- analysis DeFiLlama defillama.com
- analysis Peapods Finance Token Slips 5% after Unauthorized $200K Withdrawal thedefiant.io
- analysis July 2025 Crypto Attacks: Trends & Insights nominis.io
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
