What happened
Tinyman's January 2022 exploit let liquidity providers receive the same asset twice when redeeming pool tokens on Algorand. Attackers selected the more valuable asset, draining goBTC and goETH pools. Tinyman estimated the initial withdrawals at approximately $3 million and told users to remove liquidity.
Technical root cause
The pool-token burn path failed to enforce the intended two-asset redemption. Receiving the more valuable underlying token in both outputs allowed withdrawals to exceed the value represented by the burned pool tokens.
How it happened
- The attacker acquired assets and minted pool tokens in a targeted pool.
- A pool-token burn returned two transfers of the same asset instead of one transfer of each underlying asset.
- The attacker repeatedly extracted goBTC and goETH, then swapped the proceeds through other pools.
- Other wallets copied the exploit. Tinyman removed liquidity-addition routes from its interface and promised reimbursement.
Protocol details
Classification
Exchange (DEX) / Token & Share Accounting
Protocol Type
DEX
Implementation language
PyTeal
Protocol links
Website
@tinymanorg
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
