Arcadia Finance Falls Victim to $455,000 Hack, Exposing Code Vulnerabilities

Arcadia Finance, a non-custodial leveraged farming protocol, has suffered a security breach resulting in the loss of hundreds of thousands of dollars. The exploit was disclosed by blockchain intelligence firm PeckShield, who identified vulnerabilities in Arcadia's code on Ethereum and Optimism networks. The hacker successfully drained approximately $455,000 from the protocol by exploiting the absence of "untrusted input validation" and the "lack of reentrancy protection" in Arcadia's program code. As a consequence, the attacker gained access to the darcWETH and darUSDC wallets of the DeFi protocol.

PeckShield further highlighted a critical weakness in Arcadia Finance's security. The protocol lacked "reentrancy protection," allowing the attacker to execute instant liquidation irrespective of the internal vault health status. This flaw provided the hacker with the opportunity to exploit the system's vulnerabilities effectively. PeckShield reports that 179.03 ETH, taken from the Optimism chain, has been laundered using the Tornado Cash protocol. However, the funds obtained from the Ethereum chain remain in the possession of the hacker.

Upon receiving the security alert from PeckShield, Arcadia Finance took immediate action by halting all ongoing contracts and initiating an investigation with the assistance of security experts. The team behind Arcadia has also reached out to law enforcement authorities in response to the incident. Data from DeFiLlama reveals that the recent exploit has caused a significant decline in Arcadia's total value locked (TVL), plummeting by 76% from $604,440 to the current value of $142,824.

This attack on Arcadia Finance is just one among several instances of crypto heists that have plagued the industry in 2023. Recently, the Multichain protocol suffered a similar breach resulting in the theft of $126 million. According to a report from Certik Security, the second quarter of 2023 saw a total of over $313 million lost to crypto scams and hacks. While this figure marks a 58% decline compared to the same period in 2022, it remains consistent with the losses recorded in the first quarter of 2023, which amounted to $320 million. Notably, June recorded the highest losses in the second quarter, reaching $135.2 million, followed by April with $103 million.

Arcadia Finance has initiated contact with the attacker and is actively working to minimize the damage caused by the exploit. The protocol is collaborating with security partners, law enforcement agencies, and the broader community to recover funds and ensure the safety of Arcadia protocol users.