Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.
Reproducible Foundry test fork from SunWeb3Sec/DeFiHackLabs. Clone the repo, run forge test against the file path above, and replay the exploit against a mainnet fork at the historical block. Use for reproduction only — not for live targets.
The MEV Bot (0x05f016765c6c601fd05a10dba1abe21a04f924a5) was exploited and lost about 1k ETH! The core reason is that the 0xf6ebebbb function used to trigger arbitrage in the contract lacks authentication. The attacker calls this function to exchange the tokens in the contract into the pool on curve, and then uses funds of the flash loan to reverse exchange and obtain profit. Attack method (per SlowMist): Flash Loan Attack. Reported loss: $ 2,152,392.
- chain
- —
- protocol
- MEV Bot
- bug_class
- flashloan
- date_occurred
- 2023-11-07
- loss_usd
- $2,152,392
- source_id
- sm:mev-bot::2023-11-07