Briefing
The Abracadabra decentralized lending protocol suffered a critical exploit, allowing an attacker to drain approximately $1.8 million in Magic Internet Money (MIM) stablecoins. This breach was a direct consequence of a logic flaw within a deprecated V4 smart contract function, which failed to properly maintain state across a multi-step transaction. The primary consequence was the unauthorized minting of debt, bypassing the protocol’s fundamental solvency checks and requiring the team to purchase $1.79 million MIM to restore the peg.
Context
The prevailing security posture in the DeFi lending sector remains vulnerable to business logic flaws, particularly within complex, interconnected smart contract architectures. This risk is amplified when protocols fail to fully decommission or properly secure deprecated contract versions, leaving an unmonitored attack surface. The core vulnerability class leveraged here is the manipulation of contract state variables through multi-step operations, a known risk that bypasses standard reentrancy guards.
Analysis
The attack was executed by leveraging the cook function within a deprecated V4 Cauldron, which allows multiple operations in a single transaction. The attacker first initiated a borrow operation, then immediately exploited an ‘else’ block within the function’s logic that reset the contract’s solvency status to its default, unsecured state. This deliberate sequence disabled the internal solvency check ( needsSolvencyCheck ), allowing the attacker to borrow a substantial amount of MIM far exceeding their collateral limit. The stolen funds were subsequently laundered using a decentralized mixer to obscure the transaction trail.
Parameters
- Total Loss (MIM) → 1.79 Million MIM – The amount of the stablecoin drained from the protocol’s liquidity pools.
- Vulnerability Type → Business Logic Flaw – A critical error in the contract’s function sequencing, not a low-level coding bug.
- Affected Component → V4 Cauldron cook function – The specific, deprecated smart contract logic that enabled the exploit.
- Affected Protocol State → Solvency Check Bypass – The primary security mechanism was circumvented by resetting a critical state variable.
Outlook
Protocols must immediately adopt a zero-tolerance policy for deprecated code, prioritizing complete, irreversible contract decommissioning over simple pausing. The immediate mitigation for users is to withdraw assets from any V4-era pools or similar legacy contracts on other platforms. This incident will establish a new auditing standard focused on integrated state machine testing, ensuring that multi-step transactions cannot reset critical security variables, thereby mitigating the systemic contagion risk to other lending protocols using similar logic.
Verdict
This exploit is a definitive signal that deprecated smart contract code remains an unacceptable and critical attack vector for high-value DeFi protocols.
