Decentralized exchange Bunni says a rounding bug in its smart contract was to blame for the $8.4 million exploit that struck earlier this week. In a post-mortem released on September 4, the team detailed how the attacker exploited the flaw to manipulate two liquidity pools and siphon off millions through a flash loan attack.
The exploit hit two pools: the weETH/ETH pair on Unichain and the USDC/USDT pair on Ethereum.
How the Exploit Unfolded?
The attacker first flash-borrowed 3 million USDT, then carried out a series of swaps to push the pool’s spot price to an extreme level. This maneuver left the pool with only 28 wei of USDC in its active balance.
The real damage came next. The attacker carried out 44 tiny withdrawals, each one taking advantage of the contract’s rounding flaw. The assumption behind the design was that rounding would always go in a “safe” direction, rounding up the idle balance and rounding down the active one.
That logic may work for a single operation, but when repeated across multiple operations, it breaks down. By chaining withdrawals together, the attacker turned this “safe” rounding into a loophole, draining the pool’s active funds far beyond what was expected, wiping out more than 84% of its liquidity.
With the pool left exposed, the attacker made a big swap to push prices up, then quickly reversed the trade at the distorted rate to secure a large profit. Once the dust settled, the attacker walked away with roughly 1.33 million USDC and 1 million USDT, even after paying back the flash loan.
Why Some Pools Escaped?
Bunni noted that its largest pool, Unichain’s USDC/USD₮0, was left untouched, not because it was safer, but because the attacker couldn’t get the flashloan needed. According to Bunni, flash loan venues on Unichain didn’t have enough liquidity to push prices as required. In short, luck spared the pool.
The Flaw in the Code
The heart of the issue was a single assumption in Bunni’s withdrawal logic. Developers believed rounding balances down would protect the pool by making swaps more costly for traders. But when exploited repeatedly through tiny withdrawals, the opposite happened. Liquidity was understated to a dangerous degree, creating the opening for manipulation.
Bunni has since tested a fix by changing the rounding method, which neutralizes this specific attack. But the team admitted the incident exposed a gap in their testing framework and vowed to expand fuzz and invariant testing before resuming normal operations.
Next Steps and Recovery Efforts
The stolen funds are now sitting in two wallets tied to the attacker. Tracing efforts stalled after the funds were funneled through Tornado Cash, but Bunni said it has contacted the attacker with a proposal: return 90% of the stolen money and keep 10% as a “white-hat” reward. The team has also alerted centralized exchanges and engaged law enforcement.
Withdrawals have been reopened so liquidity providers can retrieve their assets, but deposits and swaps remain paused.
Despite the setback, Bunni’s six-person team insisted it would keep building. “We spent years of our lives and millions of dollars to launch Bunni, because we firmly believe it is the future of AMMs,” the team said in its closing note. “Regardless of what happens, we will continue to build Bunni and invent the future of DeFi.”
Also Read: Venus Recovers $13M After Phishing Attack Disrupts Protocol
