Briefing
The Bunni decentralized exchange suffered a catastrophic $8.4 million exploit that leveraged a precision bug in its custom Liquidity Distribution Function (LDF). This systemic failure forced the protocol to cease operations, underscoring the extreme risk of unaudited custom logic in core DeFi primitives. The attacker used a flash loan to manipulate pool balances, exploiting a rounding error in the withdrawal logic to systematically drain $8.4 million across Ethereum and UniChain deployments.
Context
The prevailing risk factor for protocols built on established Automated Market Maker (AMM) frameworks is the introduction of custom ‘hook’ logic. While designed for efficiency, this bespoke code often lacks the battle-testing of the core AMM, creating an expanded and novel attack surface where subtle arithmetic errors can be weaponized. The incident highlights that complexity in liquidity rebalancing logic is directly proportional to unmitigated security debt.
Analysis
The attack vector began with a flash loan to borrow a large asset quantity, which the attacker used to execute a series of carefully sized swaps. This action deliberately pushed the target pool’s token balance to a minimal, ‘dust’ level, forcing the custom LDF to trigger a rebalancing calculation. The core flaw was a rounding error in the withdrawal function that incorrectly calculated the idle balance, allowing the attacker to burn less liquidity while withdrawing a disproportionately larger amount of tokens. This systematic manipulation enabled the extraction of $8.4 million in profit.
Parameters
- Total Funds Lost → $8.4 Million (The total value drained from liquidity pools across Ethereum and UniChain)
- Vulnerability Type → Precision Rounding Error (A logic flaw in the custom Liquidity Distribution Function)
- Attack Vector → Flash Loan Manipulation (Used to unbalance the pool and trigger the flawed logic)
- Affected Chains → Ethereum and UniChain (The exploit was successful on deployments across both networks)
- Recent Activity → $7.3 Million (Amount of stolen ETH recently laundered via Tornado Cash)
Outlook
Protocols utilizing custom AMM logic must immediately conduct a full, independent formal verification of all non-standard functions to eliminate precision and rounding vulnerabilities. The contagion risk remains low for core AMM protocols but is high for forks and projects that reuse the vulnerable LDF code. This incident will establish a new best practice → treating custom liquidity logic as a high-privilege attack surface that requires the same audit rigor as the core smart contract invariants.
Verdict
The Bunni DEX exploit serves as a definitive case study that custom liquidity logic, even when layered on audited primitives, introduces unmanageable precision risk and should be treated as a critical security failure point.
