What happened
On May 8, 2021, an attacker used a dYdX flash loan to manipulate the Alpha Finance ibETH value used by Rari Capital's Ethereum Pool, extracting 2,600 ETH. Rari valued the loss at about $10 million on the day, and paused the pool after roughly 60% of its user funds had been drained.
Rari trusted an integration exchange-rate input that could be transiently manipulated during `ibETH.work`. The same execution path permitted calls into Rari's deposit and withdrawal functions, allowing withdrawals against the temporary inflated valuation.
Case & protocol details
Attack Timeline
Rari's Ethereum Pool invested ETH in Alpha Finance's ibETH and valued that position as ibETH.totalETH() / ibETH.totalSupply(). During ibETH.work, the attacker used flash-loaned ETH to temporarily raise ibETH.totalETH() and therefore inflate the value that Rari assigned to its ibETH position.
The work path allowed an arbitrary external call, so the attacker called Rari's deposit and withdrawal functions while the inflated value was live. This made the attacker's Rari pool shares redeem for more ETH than had been deposited. When ibETH.work completed, totalETH() returned to its normal value, leaving the Rari pool short. The attacker repeated the sequence until Rari paused the contracts.
Security review history
- Quantstamp Report
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.