## Arcadia Finance Exploit (ArcadiaFi) -- July 2025, Base

### 1. What happened

On July 14--15, 2025, Arcadia Finance (ArcadiaFi) was exploited on Base for **$3.6 million**. The attacker drained funds in two waves: ~$2.5 million first, then another ~$1 million about 25 minutes later while the team was still responding to the first wave. Stolen funds were converted to ETH on Base, bridged to Ethereum mainnet via Across Protocol, and split across multiple addresses. Seed funding came from Tornado Cash.

- rekt.news leaderboard lists the date as 7/15/2025 and the amount as $3,600,000 ([rekt.news/leaderboard](https://rekt.news/leaderboard))
- rekt.news article confirms the two-wave amounts totaling ~$3.6M ([rekt.news/arcadiafi-rekt](https://rekt.news/arcadiafi-rekt))

### 2. Root cause

The **RebalancerSpot contract** contained an unchecked external call in `SwapLogic._swapViaRouter()`. The call chain was `_RebalancerSpot.rebalance()` → `AccountV1.flashAction()` → `actionTarget.executeAction()` → `_swap()` → `_swapViaRouter()` → `router.call(data)`. The `swapData` parameter accepted arbitrary calldata and the router address was never validated against a whitelist. The attacker registered a malicious contract as both a router and a whitelisted Arcadia Account, then used the trusted Rebalancer context to drain victim accounts. Three of the four prior audits (Trust Security, Sherlock, Renascence Labs) had excluded the Rebalancer from scope. Pashov Group audited the Rebalancer in Q3 2024 and initially flagged the missing input validation but closed the issue as unexploitable, and it was never communicated to ArcadiaFi.

- Full exploit breakdown and audit history from ([rekt.news/arcadiafi-rekt](https://rekt.news/arcadiafi-rekt))

### 3. Pattern

**Unvalidated input / calldata (arbitrary external call).** A trusted contract (`Rebalancer`) passes caller-supplied `data` directly to a low-level `call()` on an unvalidated target address. Pseudocode of the vulnerable shape:

```
function swapViaRouter(address router, bytes calldata data) internal {
    (bool success, ) = router.call(data);   // router and data both untrusted
    require(success);
}
```

No check ensures `router` is a known, authorized swap router, and no validation inspects `data` before forwarding it. An attacker who can register an arbitrary address as a router (or who controls a registered Account) can hijack execution context and drain funds from other accounts.

- Call chain and pseudocode derived from ([rekt.news/arcadiafi-rekt](https://rekt.news/arcadiafi-rekt))

### 4. The check that would have caught it

1. **Review rule / unit test:** Every `call()` or `delegatecall()` to an address supplied by a caller must either (a) validate the target against a hardcoded or governance-set whitelist, or (b) restrict the calldata to known function selectors. A unit test asserting that `swapViaRouter` reverts when passed a non-whitelisted router address or arbitrary calldata would have caught this.
2. **Invariant test:** An invariant stating "only whitelisted routers can receive calls from the Rebalancer, and no funds can leave a victim Account through a Rebalancer call initiated by a different Account" -- fuzzed with arbitrary Account/ router/ calldata combinations -- would have surfaced the attack path that Pashov closed as unexploitable.

### 5. Sources

- [rekt.news/arcadiafi-rekt](https://rekt.news/arcadiafi-rekt) -- full exploit breakdown, audit history, attacker trail
- [rekt.news/leaderboard](https://rekt.news/leaderboard) -- amount and date confirmation

*The project's own post-mortem on Medium (arcadiafi.medium.com) and Pashov Auditing Group's post-exploit analysis could not be retrieved (Medium blocked, blog sites unreachable from this environment). They are referenced in the rekt.news article above, which credits: ArcadiaFi post-mortem, CertiK Alert (initial detection of ~$1.6M), Cyvers Alerts (additional $1M), Chaofan Shou (technical breakdown), and Pashov Auditing Group (auditor statement).*