Peapods Finance Hack

On February 8, 2025, Peapods Finance suffered an exploit due to a vulnerability in its reward contract’s depositFromPairedLpToken function. The attacker manipulated the _slippageOverride parameter, executing a sandwich attack that drained funds from the contract. The total loss amounted to approximately $3,500.

The exploit stemmed from the contract’s lack of validation on the _slippageOverride parameter, which directly influenced the amountOutMinimum value in token swaps. The attacker first manipulated the token price by executing a large trade before calling depositFromPairedLpToken with an extreme _slippageOverride value of 999. This forced the contract to accept unfavorable trade conditions, allowing the attacker to back-run their transaction and sell tokens at an inflated price for profit.

Peapods Finance has acknowledged the exploit and is currently investigating the incident.