How ArcadiaFi's Own Circuit Breaker Opened the Door to a $3.6M Rebalancer Drain

ArcadiaFi lost $3.6 million on Base after an attacker turned the protocol's own rebalancing mechanism into a withdrawal tool — and the sequence of events leading up to it began, oddly enough, with the team accidentally disabling their own defenses.

01A pause that backfired

On July 14, an unknown party deployed two contracts that tripped ArcadiaFi's automated circuit breaker, freezing the protocol outright. The team spent hours running simulations and checks against the contracts, concluded there was no immediate danger, and lifted the pause at 1:05 PM UTC. What they apparently didn't realize was that pausing and unpausing in that window had triggered a cooldown: the protocol could not be paused again for several hours, regardless of what happened next.

That gap mattered. CertiK's monitoring began flagging suspicious activity late that same evening, July 14 — a string of transactions draining funds from ArcadiaFi on Base. CertiK's public estimate at the time: roughly $1.6 million siphoned off "through arbitrary 'swapdata' on its rebalancer contract." Nine minutes after that alert, ArcadiaFi confirmed the incident, telling users it was aware of "unauthorized transactions via a Rebalancer" and urging them to revoke permissions granted to asset managers.

The attack wasn't over. Shortly after, Cyvers Alerts flagged a further $1 million leaving the protocol, pushing the combined total to $3.6 million. The stolen assets followed a familiar laundering pattern: converted to ETH on Base, bridged over to Ethereum mainnet, then split across several wallets.

02Anatomy of the exploit

Details of the mechanism come from ArcadiaFi's own post-mortem and a technical writeup by Chaofan Shou.

The attacker opened with three flashloans from Morpho totaling roughly $1.5 billion — an amount large enough to sail through ArcadiaFi's health checks unnoticed. That scale mattered because the protocol never validated the contents of the swapData parameter passed into its swap functions, meaning arbitrary calldata could be smuggled in under the guise of a routine swap instruction.

ArcadiaFi's access-control design looked sound at a glance: only an Account contract could invoke Rebalancer.executeAction(), and only the Rebalancer could invoke Account.flashAction(). In practice, the call chain undermined that guarantee. The path ran:

RebalancerSpot.rebalance() → AccountV1.flashAction() → actionTarget.executeAction() → _swap() → _swapViaRouter() → router.call(data)

At no point along that chain was the router address itself checked. The attacker exploited this by registering a malicious contract as both the "router" and a whitelisted ArcadiaAccount, then rode the Rebalancer's trusted context to drain other users' accounts. Before doing so, they used the flashloaned capital to repay the target account's existing debt, making it appear "healthy" so the withdrawal wouldn't trip any safety check. Four calls deep into the chain, the attacker effectively controlled the victim account — free to withdraw its holdings and repay the flashloan, pocketing the difference.

03Tracing the money

The operation's funding trail starts with Tornado Cash, which seeded the attacker's address with ETH at 10:58 PM UTC on July 14. The exploit itself launched at 4:05 AM UTC on July 15 — precisely inside the window when ArcadiaFi's pause function was locked by cooldown. The primary attacker address has been identified as 0x0fa54e967a9cc5df2af38babc376c91a29878615.

GoPlus Security's post-exploit analysis separated out the specific contracts involved: the vulnerable RebalancerSpot contract sits at 0xC729213B9b72694F202FeB9cf40FE8ba5F5A4509 — this is where SwapLogic._swapViaRouter() and its unchecked router.call(data) lived. The account actually drained of funds, an Arcadia Account holding LP positions, sat at 0x9529e5988ced568898566782e88012cf11c3ec99.

The first wave used an attack contract at 0x6250DFD35ca9eee5Ea21b5837F6F21425BEe4553, pulling out approximately $2.5 million across two transactions: 0x06ce76eae6c12073df4aaf0b4231f951e4153a67f3abc1c1a547eb57d1218150 and 0x0b9bed09d241cef8078e6708909f98574c33ee06abcc2f80bc41731cd462d60b. Roughly 25 minutes later — while ArcadiaFi was still assessing the first wave — a new contract at 0x1DBC011983288B334397B4F64c29F941bE4DF265 executed a second round pulling out another $1 million-plus, bringing the running total to $3.6 million.

The 840 ETH taken in the first wave was routed to Ethereum mainnet through Across Protocol in this bridging transaction, after which the funds were dispersed across multiple addresses.

04Four audits, one blind spot

ArcadiaFi's codebase had been reviewed by four separate auditors over roughly two years — Trust Security, Sherlock, Pashov Group, and Renascence Labs. Collectively they surfaced a meaningful number of issues; Sherlock alone identified 6 medium- and 3 high-severity bugs that were subsequently fixed. But three of the four reviews never touched the component that ultimately failed.

Trust Security's Q4 2023 audit covered AccountV1, the Registry, and the asset and oracle modules — not the Rebalancer. Sherlock's Q1 2024 review was scoped to the lending-v2 and accounts-v2 repositories. Renascence Labs' June 2024 audit likewise excluded any rebalancing-related contracts.

Pashov Group's Q3 2024 audit was the exception — its scope explicitly included the Rebalancer, RebalanceLogic, and SwapLogic. According to Rekt News' correspondence with Pashov Auditing Group, the team had in fact reviewed the exact SwapLogic._swapViaRouter() function and initially flagged the absence of input validation as a possible risk, but could not construct a working exploit path using a registered Account against itself mid-rebalance, and the finding was closed out. A Pashov team member told Rekt News: "We did log it as an issue, that there is an attack vector, but then couldn't exploit it, so we closed it. I believe it didn't get to the client (Arcadia), as it was in 'closed' issues." Pashov later acknowledged the gap publicly: "Arcadia Finance was exploited due to an unchecked external call in SwapLogic._swapViaRouter()." The issue never reached ArcadiaFi as an open finding, and the theoretical attack vector turned out to be exploitable after all.

05An attempted negotiation

ArcadiaFi also tried to negotiate directly with the attacker. An on-chain message offered a 10% white-hat bounty in exchange for returning the stolen funds within 24 hours. Little further detail is available, and the outreach does not appear to have led anywhere — the attacker kept the funds.

06Takeaway

ArcadiaFi's permission structure was deliberately narrow — Accounts could call the Rebalancer, and only the Rebalancer could call back into Accounts. What that design didn't account for was that the swapData payload passed between those trusted components was itself unvalidated, effectively arbitrary code masquerading as routine instructions. Combined with the accidental pause-and-cooldown sequence that left the team unable to freeze the protocol at the moment they most needed to, the incident shows how a permission system can be entirely correct on paper and still fail once trusted components are allowed to pass unchecked data to one another — a gap that sat unexamined across three of four audits and was noted, then dismissed as non-exploitable, in the fourth.