Several million dollars worth of tokens have been drained from DeFi protocol Abracadabra/Spell's “cauldrons” following a targeted hack, according to security firm Pecksheild. A vulnerability in the protocol’s smart contracts allowed the attacker to drain approximately 6,262 ETH, valued at around $13 million, from the liquidity pools.
Abracadabra/Spell's cauldrons are smart contracts that use decentralized exchange GMX liquidity pools for onchain lending and borrowing. The exploit seemingly involved manipulating the liquidation process in the integration of Abracadabra’s cauldrons on GMX V2’s GM pools.
“When performing the liquidation, the attacker actually LIQUIDATED himself within a FLASHLOAN state (P4) - where the borrower (who got liquidaited) has actually no collateral,” crypto researcher Weilin (William) Li said on X in an initial look at the situation. A flash loan is a DeFi-native trading strategy where a user takes out an uncollateralized loan and repays it within the same block.
Li added that the attacker used a seven-step process to borrow and liquidate a loan of Abracadabra’s algorithmic stablecoin Magic Internet Money. “And the attacker's profit comes from the liquidation incentives (because at the end of the function cook, the attacker's eoa needs to be solvent),” he said.
GMX V2 uses a two-step trading process where orders are created and fulfilled by “keepers” to prevent front-running. This window between order creation and fulfillment may have exposed a surface for the attacker to interfere, though a GMX developer noted that GMX’s core contracts were unaffected.
“To clarify, GMX contracts are not affected,” @Jonas_ALA said on X. “It relates to Spell's cauldrons based on GMX V2's GM pools. The contributors are currently looking into the cause, and I'd like to apologise wholeheartedly to anybody negatively affected. This is very unfortunate.”
The stolen funds have since been bridged from Arbitrum to Ethereum.
In January 2024, Abracadabra’s MIM stablecoin was manipulated leading to nearly $6.5 million worth of losses.
Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.
© 2025 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
