Briefing
The Abracadabra decentralized lending protocol suffered a $1.8 million exploit on its Ethereum-based Cauldron V4 contracts, which were deprecated but remained active. The primary consequence was the unauthorized minting and subsequent draining of 1.79 million Magic Internet Money (MIM) stablecoins, which the protocol’s DAO treasury was forced to buy back to stabilize the asset’s peg. The core vulnerability was a critical logic error within the cook() multi-action function that allowed the attacker to repeatedly bypass the mandatory collateral solvency check. This incident represents a significant financial loss for the protocol’s treasury and underscores a fundamental failure in code lifecycle management.
Context
This incident follows a pattern of recurring security lapses for the protocol, which had previously suffered over $19 million in losses from similar smart contract exploits in 2024 and 2025. The prevailing attack surface was the continued operational status of deprecated smart contracts, which often receive less security scrutiny and are not subject to the same strict access controls or code updates as active, audited versions. The failure to fully deactivate or sunset old contract versions created an unnecessary and high-value attack vector.
Analysis
The attack leveraged a flaw in the cook() function, which processes multiple operations within a single transaction using a shared CookStatus struct. The attacker initiated a borrowing action (Action 5), which correctly set the needsSolvencyCheck flag to true. Crucially, they immediately followed this with a different action (Action 0) that was implemented to reset the shared struct to its default state.
This reset inadvertently cleared the needsSolvencyCheck flag to false, effectively nullifying the collateral requirement and enabling the attacker to repeatedly borrow MIM without sufficient backing, thus draining the $1.8 million. The attacker converted the stolen MIM to ETH and laundered the funds through Tornado Cash.
Parameters
- Total Funds Drained → $1.8 Million – The value of the 1.79 million MIM tokens stolen from the deprecated Cauldron V4 contracts.
- Affected Asset → 1.79 Million MIM – The exact amount of the Magic Internet Money stablecoin that was unauthorizedly minted and drained.
- Vulnerable Contract State → Deprecated V4 Cauldron – The specific, older smart contract version on Ethereum Mainnet that contained the exploitable logic flaw.
- Attack Vector Root Cause → CookStatus Reset Logic – The shared state variable in the cook() multi-action function that was reset, bypassing the solvency check.
Outlook
Protocols must immediately implement a rigorous decommissioning policy to ensure all deprecated smart contracts are fully deactivated, ideally by revoking all permissions or migrating all remaining liquidity. This incident reinforces the principle that code, once deployed, is an immutable liability if not properly secured or sunsetted. Users of similar multi-action DeFi protocols should verify that all associated contracts, especially older versions, have been formally audited and are not exposed to state-reset vulnerabilities. The DAO’s treasury buyback is a necessary, short-term stabilization measure, but it is not a sustainable security practice.
Verdict
The exploit of an active, deprecated smart contract highlights the systemic risk of poor code lifecycle management, affirming that any un-sunsetted contract is an open vulnerability for the entire protocol.
