Bunni DEX Suffers $8.4 Million Flash Loan Rounding Error Exploit → Security

The image displays a detailed view of a complex blue and silver mechanical component, prominently featuring a central block-like unit with an exposed shaft and intricate paneling. Surrounding this core mechanism are numerous dark blue cables and metallic connectors, suggesting a sophisticated interconnected system

A high-tech apparatus featuring a dark gray block with blue and gold accents is prominently displayed, intricately connected by multiple flexible, textured conduits and interwoven black cables. The conduits exhibit a distinctive distressed blue circuit-like pattern, emerging from and connecting to the central unit with bright blue bands

Briefing

The Bunni decentralized exchange (DEX) was recently compromised by a sophisticated flash loan attack that exploited a critical rounding error in its liquidity withdrawal mechanism across Ethereum and UniChain. This vulnerability allowed an attacker to disproportionately drain assets from liquidity pools, directly impacting user funds and protocol integrity. The incident resulted in a total financial loss of $8.4 million, highlighting severe flaws in the smart contract’s fundamental logic.

A futuristic mechanical assembly is presented on a clean, light grey background, featuring a translucent faceted blue structure at its core, intricately intertwined with metallic gears and a dark blue cylindrical component. A small white sphere rests atop silver metallic elements, while other hexagonal metallic pieces are visible

Context

Prior to this incident, the DeFi ecosystem has consistently faced risks from complex smart contract interactions, particularly in liquidity provision mechanisms. Rounding errors, while often subtle, represent a known class of vulnerability that can be leveraged by flash loans to manipulate protocol state and asset balances. The inherent composability of DeFi protocols expands the attack surface, making rigorous, multi-faceted audits essential to prevent such exploits.

A detailed, close-up view shows a light blue, textured surface forming a deep, circular indentation. A spherical object resembling a full moon floats centrally above this void, symbolizing a digital asset experiencing significant price action or 'mooning' within the DeFi landscape

Analysis

The attack targeted Bunni’s smart contract logic, specifically its withdraw function within liquidity pools. The attacker initiated a flash loan to acquire substantial capital, which was then used to execute a series of carefully timed swaps within the weETH/ETH and USDC/UDST pools. This manipulation exploited a critical rounding error, where the withdraw function, intended to round down idle balances, inadvertently did the opposite, allowing the attacker to extract more tokens while burning less liquidity. A subsequent sandwich attack further amplified the price distortion, enabling the attacker to drain significant value from the pools and profit after repaying the flash loan.

A futuristic, translucent blue spherical object, resembling a secure network node, features a prominent central display. This display presents a dynamic candlestick chart, showing real-time price action with distinct bullish blue and bearish red patterns, partially veiled by metallic grilles

Parameters

Protocol Targeted → Bunni DEX
Attack Vector → Flash Loan & Rounding Error Exploit
Total Financial Impact → $8.4 Million
Affected Blockchains → Ethereum, UniChain
Vulnerability Root Cause → Smart contract withdraw function rounding error

The image displays a detailed, close-up view of intricate metallic and electric blue machinery components. Various black and blue cables interconnect these robust parts, suggesting a sophisticated electronic device

Outlook

This incident underscores the critical need for exhaustive smart contract auditing, particularly focusing on edge cases and precision in arithmetic operations within liquidity mechanisms. Protocols employing similar Uniswap v4-based liquidity management should immediately review their withdraw functions for comparable rounding vulnerabilities. The broader DeFi community must adopt more stringent pre-deployment testing and formal verification methods to prevent such subtle yet devastating logic flaws from becoming systemic risks.

The image displays an abstract 3D rendering featuring a central mass of interconnected, translucent blue cubic forms. These are partially enveloped by smooth white tubular structures, with fine white and black lines extending from small white spheres, connecting various elements

Verdict

The Bunni hack serves as a stark reminder that even seemingly minor arithmetic flaws in smart contract logic can be weaponized by sophisticated flash loan attacks, necessitating an unyielding commitment to precision in DeFi security.

Signal Acquired from → Halborn