What happened
On March 5, 2024, an attacker exploited WOOFi Swap's synthetic proactive market maker on Arbitrum. Flash-borrowed WOO and low available liquidity let the attacker force WOOFi's internal WOO price close to zero, acquire WOO at a negligible cost, and extract value through three rapid attack cycles.
WOOFi's sPMM price calculation could push WOO's internal price far outside its intended range under a large trade. The fallback validation that would compare against Chainlink did not cover WOO, so the implausible price was accepted instead of reverting.
Case & protocol details
Attack Timeline
The attacker borrowed WOO and other assets through flash-loan arrangements, sold WOO into WOOFi, and triggered an extreme internal WOO price adjustment. With the manipulated price near zero, the attacker swapped out roughly 10 million WOO for almost no cost, unwound the position, and repaid the loans. Repeating the sequence three times produced about $8.75 million in net profit after flash-loan repayment.
The affected sPMM pricing path normally uses oracle validation as a fallback. WOO was not covered by that Chainlink fallback, so the implausible internal price was accepted instead of reverting. WOOFi paused the Arbitrum Swap contracts shortly after detection; its other product contracts were unaffected.
Security review history
- CertiK Report
Evidence & learning
Proof of concept
1 availableSources and on-chain records
- report Report twitter.com
- report WOOFi sPMM Exploit Post-Mortem woox.io
- transaction Transaction arbiscan.io
- analysis Twitter/X Alert twitter.com
- analysis Twitter/X Alert twitter.com
- analysis Website reference twitter.com
- analysis Website reference twitter.com
- analysis WOOFi Flash-Loan Exploit on Arbitrum dn.institute
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.