Incident Overview
On February 8, 2025, Peapods Finance suffered an exploit due to a vulnerability in its reward contract’s depositFromPairedLpToken function. The attacker manipulated the _slippageOverride parameter, executing a sandwich attack that drained funds from the contract. The total loss amounted to approximately $3,500.
The exploit stemmed from the contract’s lack of validation on the _slippageOverride parameter, which directly influenced the amountOutMinimum value in token swaps. The attacker first manipulated the token price by executing a large trade before calling depositFromPairedLpToken with an extreme _slippageOverride value of 999. This forced the contract to accept unfavorable trade conditions, allowing the attacker to back-run their transaction and sell tokens at an inflated price for profit.
Peapods Finance has acknowledged the exploit and is currently investigating the incident.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Peapods Finance, these are the critical security checks that could have prevented this incident (February 2025).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Audit Report 1 Report
Sources & References
Learn to Prevent the Next Peapods Finance
The Peapods Finance hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.