Digital Asset
Intelligence
Security Incident · ETH Ecosystem

Alchemix Contract Vulnerability: $6.53M Reported Loss

·Historical incident record

Incident Overview

The DeFi lending agreement Alchemix alETH pool is suspected to have a loophole, and users can raise collateralized ETH when they have outstanding alETH debts. Alchemix released an alETH pool accident report stating that due to an error in the deployment of the alETH pool script, users have borrowed alETH at a 4:1 mortgage ratio but have no debt to be repaid, and the debt ceiling of nearly 2000 ETH has been released and new ones can be minted again. alETH, combined with Alchemix's use of the wrong index in the vault array, forced the transmuter to support the agreement mechanism to completely send the funds to repay the user's debt. The team has stopped the mortgage lending of the pool. As of the time of the report, alETH currently has a gap of -2,688.634, which is about 6.53 million U.S. dollars. Alchemix stated that there was no loss of user funds, and Yearn did not suffer any loss.

Sources & References

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    Alchemix

    Attack methodAffected by Vyper Vulnerability
    Reported loss$ 35,315,843
  2. Incident date
    Attack methodPermission Stolen
    Reported loss$ 504,845
  3. Incident date
    Attack methodOperation error
    Reported loss$ 75,000,000
  4. Incident date
    Attack methodContract Vulnerability
    Reported loss$ 500,000
  5. Incident date
    Target

    EvoDefi

    Attack methodFlash loan attack
    Reported loss$ 1,000,000