Incident Overview
On April 30, 2024, Pike Beta protocol suffered an exploit resulting in the loss of 99,970.48 ARB, 64,126 OP, and 479.39 ETH, totaling over $1.6 million. The attack was related to a vulnerability initially reported on April 26 concerning USDC, prompting protocol upgrades that inadvertently introduced new variables and storage misalignment, allowing attackers to withdraw funds.
Pike is a liquidity market facilitating lending and borrowing using native assets directly on their respective blockchains, without wrapping or cross-chain transfers. The exploit exploited a vulnerability introduced during protocol upgrades aimed at addressing an earlier USDC vulnerability. The attacker leveraged an upgrade function to insert their address into the protocol's active variable, allowing them to bypass admin access and withdraw funds.
Attacker Address: 0x19066f74…D89E23
Attacker Contract: 0x1da4Bc59…C47fbD
Victim Contract: 0xFC7599cf…d2F063
Optimism Transaction: https://optimistic.etherscan.io/address/0x19066f74…d89e23
Arbitrum Transaction: https://arbiscan.io/address/0x19066f74…D89E23
Ethereum Transaction: https://etherscan.io/tx/0xe2912b8b…e66431
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Pike Finance, these are the critical security checks that could have prevented this incident (April 2024).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Pike Finance
The Pike Finance hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.