Rari Capital Hack
What happened
On May 8, 2021, an attacker used a dYdX flash loan to manipulate the Alpha Finance ibETH value used by Rari Capital's Ethereum Pool, extracting 2,600 ETH. Rari valued the loss at about $10 million on the day, and paused the pool after roughly 60% of its user funds had been drained.
Rari trusted an integration exchange-rate input that could be transiently manipulated during ibETH.work. The same execution path permitted calls into Rari's deposit and withdrawal functions, allowing withdrawals against the temporary inflated valuation.
How it happened
Rari's Ethereum Pool invested ETH in Alpha Finance's ibETH and valued that position as ibETH.totalETH() / ibETH.totalSupply(). During ibETH.work, the attacker used flash-loaned ETH to temporarily raise ibETH.totalETH() and therefore inflate the value that Rari assigned to its ibETH position.
The work path allowed an arbitrary external call, so the attacker called Rari's deposit and withdrawal functions while the inflated value was live. This made the attacker's Rari pool shares redeem for more ETH than had been deposited. When ibETH.work completed, totalETH() returned to its normal value, leaving the Rari pool short. The attacker repeated the sequence until Rari paused the contracts.
Protocol details
Security review history
- Quantstamp View report
Evidence
- report @FrankResearcher incident report twitter.com
- report Rari Capital Ethereum Pool Post-Mortem medium.com
- report Post-mortem rekt.news
- analysis DeFiLlama defillama.com
- analysis Price Manipulation Attack in Reality: RariCapital Incident blocksec.com
- analysis Rari Capital Plans to Refund Stolen Ethereum coindesk.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
