Seneca Protocol hack — February 2024

On 28 February 2024 an attacker drained roughly $6.4 million, mostly in ether, from wallets that had granted token approvals to Seneca's Chamber contracts on Ethereum and Arbitrum. Seneca operated a collateralised debt position system that issued the senUSD stablecoin.

The Chamber contract exposed a public function, performOperations(), which took an action code and arbitrary call data and then forwarded that call to any address the caller specified, with no validation of the target or the payload. The attacker used it to make the Chamber contract call transferFrom() on tokens users had already approved to Chamber, sending them from the victims' wallets to an address the attacker controlled. Assets deposited into Seneca's own vaults and staking contracts were not touched; the losses fell on users holding live approvals. A second defect made things worse: the pause and unpause functions were declared internal, so the team could not halt the contracts while the drain ran. That was flagged by researcher ddimitrov22 and reported by Cointelegraph, which also cited CertiK and the investigator Spreek. CryptoPotato reported that researcher Daniel Von Fange had raised the flaw before the attack and was removed from the project's Discord, and quoted Seneca saying the deployed Chamber code matched the audited code apart from fixes the auditor requested.

Seneca posted an on-chain message on 29 February offering a 20 percent bounty for the return of the funds and warning of legal action. Within hours the attacker returned 1,537 ETH, about $5.3 million, and kept 300 ETH, about $1 million, split across two addresses. Published loss figures cluster at $6.4 million, equivalent to more than 1,900 ETH plus 50,000 senUSD; some technical write-ups round it to "over $6 million".