Pike V1 Hack

Reported loss $1.6M
Arbitrum Ethereum Optimism
Storage Misalignment Exploit

What happened

On April 30, 2024, Pike Beta, a cross-chain lending market for native assets, was exploited for 99,970.48 ARB, 64,126 OP and 479.39 ETH, about $1.6-1.68 million across Ethereum, Arbitrum and Optimism. It was Pike's second loss in four days. On April 26 an attacker had used a forged CCTP message to drain about $299K of USDC on Arbitrum.

To pause the protocol after that first incident, the team upgraded the spoke contracts with an added pause dependency. The new variables shifted the storage layout and collided with the slot holding the initialized flag, so the proxies read as uninitialized. The attacker re-ran initialize(), made themselves the privileged isActive address, and upgraded the contracts to a malicious implementation that withdrew the funds.

Pike offered a 20% reward for the return of funds. Rekt reported that Pike had no public audits or bug bounty at the time. CertiK traced the attacker's funding through Railgun and the proceeds bridged back to Ethereum via Li.Fi, with 562 ETH returned to Railgun.

Attacker: 0x19066f7431df29A0910d287C8822936Bb7D89E23 Attacker contract: 0x1da4Bc596BFb1087f2F7999b0340Fcba03C47fbD Victim contract: 0xFC7599cfFea9De127a9f9C748CCb451a34d2F063 Ethereum exploit transaction: 0xe2912b8bf34d561983f2ae95f34e33ecc7792a2905a3e317fcc98052bce66431

How it happened

  1. After the April 26 CCTP exploit, Pike upgraded its spoke contracts with a pause dependency whose new state variables changed the storage layout.
  2. A new variable took the slot of the initialized flag, so the flag read as false and the proxy behaved as if never initialized.
  3. The attacker called initialize() again and set the isActive privileged variable to their own address.
  4. Holding that role, the attacker called upgradeToAndCall() to point the proxy at a malicious implementation.
  5. The malicious implementation withdrew ETH, ARB and OP from the spoke contracts on Ethereum, Arbitrum and Optimism.

Protocol details

Classification Protocol Logic / Access Control / Bridge
Protocol Type Lending
Implementation language Solidity
Protocol links Website @PikeFinance

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes