How a Permissionless Accounting Function Let a $280M Flash Loan Drain Makina's Curve Vault

Makina Finance lost $4.13 million on January 20th after an attacker manipulated the protocol's internal price oracle inside a single atomic transaction — a technique that PeckShield flagged publicly and that mirrors, almost word for word, an attack vector Cantina had listed as out of scope for its bug-bounty competition on the protocol just months earlier.

The Cantina scope document had explicitly carved out "losses caused by oracle price/liquidity pool manipulation, where an unchecked synchronous deposit is used." That same mechanism is what let Dialectic — Makina's first Operator — down a path that ended in a drained pool, after Dialectic had deployed DUSD tokens into Curve pools whose share-price logic simply trusted whatever spot price the pool reported at any given instant.

The mechanics were straightforward: borrow a flash loan, push a manipulated price into the protocol's accounting, and withdraw against that inflated value before repaying the loan. Attackers borrowed $280 million to pull it off, in one transaction, with no time-weighted pricing and no delay to interrupt the sequence.

Ironically, the attacker who set up the exploit didn't keep the proceeds. MEV bots front-ran the original attacker, intercepting the trade and splitting the $4.13 million haul across two separate addresses. Makina's public response was a series of on-chain messages offering the MEV operators a 10% bounty in exchange for returning funds that, by that point, were already at risk of being moved further.

The protocol had gone through six separate audit engagements with ChainSecurity, OtterSec, SigmaPrime, Enigma Dark, and Cantina — all of which signed off on a "high level of security" — while Makina marketed itself as infrastructure where "every new protocol integration no longer requires new code, new audits, nor does it introduce new attack vectors." The irony is that flexibility itself turned out to be the exposed attack surface.

01Detection and Response Timeline

TenArmor's monitoring systems flagged suspicious activity on Makina Finance on January 19th. The exploit targeted the DUSD/USDC CurveStable pool, with 1,299 ETH (roughly $4.13 million at the time) ultimately swept out.

ExVul's initial diagnosis pinned the root cause on a specific value: "The lastTotalAum value is derived from Curve pool states which can be manipulated within a single atomic transaction via flash loans." CertiK subsequently confirmed that the bulk of the stolen funds had ended up with an MEV builder address rather than the original exploiter.

That's the unusual twist in this case. According to Makina's own incident update, the original attacker address — 0x2F934B0Fd5c4f99BAb37d47604a3a1AEADEF1CCc — deployed an unverified exploit contract in block 24273361. One block later, an MEV searcher (0x935bfb495E33f74d2E9735DF1DA66acE442ede48) decompiled that contract, copied its logic, and executed the same attack first. The result was two operators, two wallets, and an uneven split: roughly $3.3 million in one address and $880,000 in the other.

PeckShield's tracking put the total at 1,299 ETH divided between 0xbed26250Db2097318386F540fD546acEDf7bdE25 and 0x573Db3Aed219EfD4D2cDABC0D00366E7B80F910E — the latter labeled as a Rocket Pool Node Distributor on Arkham.

Rather than escalating immediately, Makina opened a negotiation, sending an on-chain message to one of the addresses tied to the MEV front-running. The offer: a 10% whitehat bounty — keep up to 102.3 ETH, return 920.7 ETH — with a 24-hour deadline and a warning that non-cooperation would lead to "judicial matter" escalation. That message was sent in transaction 0xc5c5898eaf8c9ac7bee2c28eb971e8c5fee51c9ecdaf48b42c3357186c0235bf.

Notably, Hypernative had detected an attack attempt one block before the actual exploit — a warning that arrived too late to prevent the loss. By the time Makina published its incident update, the damage had been contained but not reversed: the Security Council triggered recovery mode, pausing all Machines in coordination with SEAL911 and its security auditors.

Makina stated the impact was isolated to LPs in the DUSD/USDC Curve pool, with DUSD holders, Pendle positions, Gearbox integrations, and other Machine tokens unaffected. The protocol also said it had identified leads on the MEV operators and had "strong reasons to believe they'll be cooperative."

Dialectic, Makina's first Operator and a strategic design partner, had moved DUSD into Curve pools in late October 2025 as part of Season 1's shift toward active management. Six weeks later, the pricing mechanism underlying that move was exploited.

02The Mechanism: A Price Oracle With No Guardrails

Unlike exploits that rely on reentrancy or complex multi-block MEV sequencing, this one exploited something simpler: the protocol's own accounting function could be triggered mid-transaction by anyone.

Makina's share-price oracle — which determines the value of DUSD — depended on a function called updateTotalAum(). AUM stands for Assets Under Management, the total value the Machine controls. The concept is simple; the implementation had a critical flaw: updateTotalAum() was permissionless, callable by anyone, at any time, including mid-transaction.

The function sourced its data from calc_withdraw_one_coin() on Curve's MIM/3CRV pool — a function that estimates withdrawal value based on whatever the pool's balances happen to be at that exact moment. There was no time delay and no TWAP built into the oracle. The function would read the Curve pool's current state, calculate a coin's value from that instantaneous balance, lock the result into lastTotalAum, and update the share price accordingly — all within the same block.

CertiK's n0b0dy summarized the flaw plainly: "the price anchor is fully manipulable in the same transaction... the Curve pool pays out at the distorted rate." The design had no access control on updateTotalAum(), no time-weighted average pricing, no delay between price updates, no minimum interval between calls, no check against prior values, and no circuit breaker for abnormal swings — just a permissionless function reading spot prices from pools that could be pushed around with borrowed capital.

The pathway existed because Caliber's accountForPosition() function permitted pre-approved Weiroll commands, and calc_withdraw_one_coin() — the exact function vulnerable to flash-loan manipulation — was among them.

03How the Attack Executed

Borrowing the capital. The attacker took out a $280 million flash loan, split between Morpho ($160.6 million) and Aave V2 ($119.4 million). None of this capital needed to be the attacker's own — it only had to exist for the duration of one transaction.

Skewing the pools. The attacker then distorted balances across the DUSD/USDC, 3pool, and MIM-3CRV Curve pools by dumping 170 million USDC into them. This pushed pool ratios far enough that DUSD appeared to be worth more than its actual value — not because the pools malfunctioned, but because they responded exactly as designed to a sudden, artificial demand shock.

Locking in the inflated price. With the pools skewed, the attacker called accountForPosition() and updateTotalAum(). That call pulled values from calc_withdraw_one_coin() on the now-manipulated pools, which returned inflated figures. lastTotalAum updated, and getSharePrice() recalculated accordingly — DUSD instantly appeared more valuable than moments earlier, purely because the internal accounting said so, not because anything in the market had changed.

Cashing out. The attacker then traded the remaining 110 million USDC into the roughly $5 million DUSD/USDC pool, swapping DUSD for USDC and withdrawing LP tokens at the now-inflated valuation. This drained 5,107,871 USDC from that pool. The attacker repaid the flash loans and kept roughly $4.13 million in profit, converting it to WETH via Uniswap V3 — all within a single transaction, in one block.

Blocksec's Phalcon trace confirms the sequencing: updateTotalAum() was called before the DUSD-to-USDC swap and LP withdrawal, at lines 1062 through 1067 of the trace.

Multiple firms independently converged on the same root cause: ExVul cited "share price oracle manipulation via lastTotalAum"; CertiK described "MachineShareOracle manipulated using 280M USDC flash loan"; SlowMist traced "AUM pushed up through calc_withdraw_one_coin manipulation"; and Blocksec Phalcon identified a "spot price calculation that allowed for an arbitrage attack". None of the code broke — it executed exactly as written, which was the underlying problem.

04Tracing the Funds

The primary attack transaction is recorded on-chain at 0x569733b8016ef9418f0b6bde8c14224d9e759e79301499908ecbcd956a0651f5, draining over $4 million in a single call.

Key addresses identified so far:

• Original attacker (deployed the exploit contract in block 24273361): 0x2F934B0Fd5c4f99BAb37d47604a3a1AEADEF1CCc
• MEV searcher (decompiled and replicated the attack in block 24273362): 0x935bfb495E33f74d2E9735DF1DA66acE442ede48
• Attacker's exploit contract (handled flash-loan coordination, pool manipulation, AUM updates, and withdrawals): 0x454d03b2a1D52F5F7AabA8E352225335a1b724E8
• Targeted pool (DUSD/USDC Curve StableSwap): 0x32E616F4f17d43f9A5cd9Be0e294727187064cb3
• Exploited Caliber contract (exposed accountForPosition() with pre-approved Weiroll commands including calc_withdraw_one_coin()): 0x06147e073B854521c7B778280E7d7dBAfB2D4898

Flash loan sources broke down as follows: Morpho supplied 160,590,920,349,812 USDC, and the Aave V2 Lending Pool supplied 119,409,079,650,188 USDC, for a combined total of 280 million USDC.

The MEV builder address that intercepted and reordered the transaction, capturing the majority of the profit, is 0xa6c248384C5DDd934B83D0926D2E2A1dDF008387. The stolen funds landed in two addresses that Makina describes as belonging to what it believes are non-malicious MEV operators:

• MEV recipient 1: 0xbed26250Db2097318386F540fD546acEDf7bdE25 — holding 1,062 ETH (~$3.3M)
• MEV recipient 2: Rocket Pool Node Distributor, which received 276 ETH from the exploit — 0x573Db3Aed219EfD4D2cDABC0D00366E7B80F910E

A related, identified-but-not-yet-contacted Rocket Pool validator owner address, 0x3b6fc5cc2feefc357212617930aedac9493288af, holds 276 ETH ($880K). Combined, MEV addresses captured 1,299 ETH ($4.13M). The fund movement to MEV Address 1 is recorded at 0x14d2725f4cac331740b053ae49176cec780b556e4aacc3a9f70d77644e97a2a7.

Makina's two on-chain outreach messages are recorded at 0xc5c5898eaf8c9ac7bee2c28eb971e8c5fee51c9ecdaf48b42c3357186c0235bf and 0xfe12d36617e2d1d6ab43716159ad7737606837fe9ea0cb781054f6f3c4fea52f, sent to both MEV addresses offering a 10% bounty: "The 1,023 ETH you received has come from a smart contract exploit. We do not believe this was intentional on your part. Return 920.7 ETH, keep 102.3 ETH as whitehat bounty." Funds were to be returned to a recovery wallet at 0x62244C74e1d09b3D86EF7342d354b5D7770bDE10. The 24-hour deadline passed with no response.

Recovery efforts continue: Makina is working to recover roughly 1,023 ETH from the MEV builder and is reaching out to identify the owner of the Rocket Pool validator address noted above. Separately, Dialectic is returning $104,491 in LP fees it inadvertently earned during the exploit to affected users. Makina is targeting Monday, January 26th to reactivate redemptions once a patch audit is complete, and plans to deprecate the DUSD/USDC Curve pool entirely in favor of Uniswap. Meanwhile, the original attacker's address holds nothing — it was front-run before it could collect any of the proceeds.

05Six Audits, One Uncovered Gap

Makina's security track record wasn't thin on paper: six audit engagements across five firms over five months.

• Enigma Dark — Makina-Core fuzz/invariant testing (July 2025)
• SigmaPrime — Makina-Core & Makina-Periphery (August 2025)
• ChainSecurity — Makina-Core (September 2025)
• ChainSecurity — Makina-Periphery (September 2025)
• Cantina — CTF competition (September 18 – October 15, 2025)
• OtterSec — Makina-Core & Makina-Periphery (November 2025)

The Cantina engagement was a live CTF-style bug bounty where participants could keep funds from any valid exploit they found against real contracts — except for a defined list of excluded attack vectors. The scope document explicitly excluded "losses caused by oracle price/liquidity pool manipulation, where an unchecked synchronous deposit is used," along with "any loss of funds or share price inconsistency caused by faulty instructions." That first exclusion describes, almost verbatim, the attack that drained $4.13 million three months later — and it wasn't buried in an appendix; it sat directly in the out-of-scope section.

The timeline shows how the gap opened up: core infrastructure was audited and approved between July and November 2025. Season 0 launched on September 29, 2025, bringing DUSD, DETH, and DBIT online. The Cantina CTF closed on October 15, 2025 with oracle manipulation still excluded from its scope. Season 1 began on October 27, 2025, with Dialectic shifting from passive Morpho lending to active management. Sometime after that, DUSD was deployed into Curve pools, putting the share-price oracle live with zero pricing delay — permissionless AUM updates, no TWAP, no access control — sitting in production for six weeks before the exploit occurred on January 19, 2026.

In other words, the vulnerable component wasn't in the code that had been audited — it was in an integration deployed after every audit had already concluded. That leaves responsibility split across several parties: Makina designed the MachineShareOracle and built updateTotalAum() as a permissionless function, and it allowed Operators to run arbitrary strategies through pre-approved Weiroll commands — one of which was the vulnerable calc_withdraw_one_coin() call on Curve pools. Meanwhile, Dialectic, as Operator and strategic design partner, selected which pools to deploy into and managed the strategy under its own risk framework.

The accountForPosition() function in Caliber was Makina's own code, and its pre-approved Weiroll command set included calc_withdraw_one_coin() on Curve pools. The oracle itself carried no time delay, no TWAP, and no access control.

Makina had pitched its architecture to investors as one where "every new protocol integration no longer requires new code, new audits, nor does it introduce new attack vectors" — flexibility as the core selling point, deployable to any protocol without custom adapters or new audit cycles. That same flexibility became the exploited surface, on a protocol holding roughly $100 million in TVL at the time of the exploit.

06The Takeaway

Six audits verified that the reviewed code behaved as written; none of them were asked to evaluate whether the underlying design — an oracle that trusts spot prices from pools reachable within the same transaction — was safe in the first place. Cantina's CTF had already flagged that category of risk as out of scope before the vulnerable Curve integration was even deployed.

Dialectic, widely regarded as one of DeFi's more careful asset managers, chose the pools; Makina built the oracle that priced them. The vulnerability sat in the space between those two responsibilities — live in production, backing roughly $100 million in TVL, three months after the last audit had wrapped.

The stolen funds remain effectively frozen for now, with Makina pursuing contacts at MEV infrastructure providers in hopes that whoever front-ran the original attacker chooses cooperation over keeping the proceeds. In the end, MEV bots — not the original exploiter — ended up holding most of the stolen $4.13 million while Makina's team worked to respond and negotiate a return.