Thala (ThalaSwap) hack — November 2024

Thala is a decentralised finance protocol on the Aptos blockchain running an automated market maker, a liquidity staking product and the MOD stablecoin. On 15 November 2024, beginning at about 12:46 UTC, an exploiter withdrew liquidity provider tokens worth $25.5 million from Thala's v1 farming contracts.

The flaw lay in an unstake_max function introduced by a two-line patch to the boosted farming contracts on 1 November. The function never checked that the amount a caller requested was no more than the amount they had staked, so the exploiter could ask for an arbitrary quantity and receive LP tokens they had never deposited. The MOD/USDC, MOD/THL and THAPT/APT pools were affected. Thala's post-mortem says the patch skipped its normal security review because the change looked trivial.

Thala paused the affected contracts and froze roughly $11.5 million of the drained assets that were its own tokens, about $9 million of MOD and $2.5 million of THL, which limited what the exploiter could sell. Members of the SEAL 911 emergency response group, the security researcher known as Ogle, the audit firm OtterSec and law enforcement worked on identifying the exploiter. SEAL 911 member pcaversaccio said on-chain links made identification possible within minutes, after which the exploiter made contact and returned the funds without extended negotiation.

Everything was back with Thala by about 19:13 UTC the same day, roughly six and a half hours after the first exploit transaction, less $340,000 made up of a $300,000 protocol bounty and $40,000 in personal compensation to Thala's founders. The exploiter was never publicly named and no charges have been reported.