Abracadabra.money (Cauldrons) hack — January 2024

On 30 January 2024 an attacker drained about $6.49 million of Magic Internet Money from Abracadabra.money's cauldrons on Ethereum. PeckShield first flagged the transactions and CertiK attributed the cause to a rounding error. Coverage cites either $6.49 million or $6.5 million, which are the same estimate rounded differently.

Cauldrons are Abracadabra's isolated lending markets, where users deposit interest-bearing collateral and borrow the MIM stablecoin against it. The defect lay in how total debt was tracked. When repayForAll() was called it zeroed the elastic side of the totalBorrow structure but not the base side, leaving the two inconsistent. By repeatedly calling userBorrowPart() and repay() against that state, the attacker drove the borrow 'part' value up exponentially through precision loss, which let the insolvency check be bypassed and a heavily inflated MIM loan be taken against collateral that did not support it. The attack contract was funded with 1 ETH routed through Tornado Cash.

Selling the borrowed MIM broke the stablecoin's peg. MIM fell to about $0.76 to $0.77 within an hour of the exploit becoming public, recovered to around $0.94 the same day and was near $0.98 by the following morning.

The MIM team said its engineers were triaging the incident and that the DAO treasury would buy MIM back from the market and burn it to stabilise the peg. Hours later it told users to revoke all smart-contract approvals. The attacker was not identified and the funds were not recovered.