Predy finance Hack

What happened

On May 14, 2024, Predy Finance's PredyPool on Arbitrum was drained for roughly $464,000 (about 219,586 USDC and 83.9 WETH). The attacker created a duplicate USDC/WETH pair and used Predy's trade callback to move liquidity from existing pairs into the attacker-controlled pair, then withdrew it. Predy temporarily paused the pool after the incident.

How it happened

1. The attacker registered a new USDC/WETH pair even though existing pairs used the same assets.
2. A zero-size trade() on that pair invoked the attacker-controlled predyTradeAfterCallback() while the attacker contract held the pool lock.
3. During the callback, the attacker used take() to remove USDC and WETH from the shared pool, then supplied those assets to the attacker-controlled pair.
4. The post-callback balance check saw assets still in the overall pool and passed; the attacker then burned the new pair's LP tokens to withdraw the assets.

Protocol details

Classification Borrowing and Lending / Access Control

Protocol Type Exploit/Other

Implementation language Solidity

Protocol links Website @predyfinance

Evidence

• report @CyversAlerts incident report twitter.com
• transaction Attack transaction · Arbiscan arbiscan.io
• address Attacker address · Arbiscan arbiscan.io
• code Predy Finance — Cross-Pair Accounting Discrepancy (Accounting Error) Analysis github.com
• analysis DeFiLlama defillama.com
• analysis Predy Finance Attack - How a Liquidity Pool Can Be Drained blog.verichains.io
• analysis Predy Finance Medium publication predyfinance.medium.com

Understand the attack patterns

Compare incidents →

Access Control Attacks