6 Jun 2025
ALEX Lab (Stacks): Self-Listing Helper Incident, 6 Jun 2025
ALEX: on 6 Jun 2025 a security incident hit its Stacks DEX pools (STX, sBTC, USDC, USDT and others). Stacks Foundation says the root cause was ALEX's application-level verification, not a Stacks protocol flaw.
- Event date
- Incident typeSmart-contract exploit
- Bug classValidation
- Published
Loss, as sourced
Not quantified in the Stacks Foundation statement. Secondary reports cited figures around $8–16M; those are not adopted here pending ALEX's formal post-mortem.
Traceability
Primary sources
In brief
Root cause: Per Stacks Foundation / Bitcoin L2 Labs CTO: not a Stacks limitation. ALEX relied on was-tx-mined-compact (mined-in-block) without verifying execution success for self-listing — an application verification flaw.
Timeline, as sourced: Per Stacks Foundation: 6 Jun incident; same-day clarification that Stacks protocol was not at fault; ALEX recovery/compensation underway; formal ALEX post-mortem awaited as of the Foundation post.
Account, as sourced
Claimed (Stacks Foundation) (statement (opens in a new tab)): other Stacks DEXes implemented contracts without this vulnerability.
Unknown: ALEX's own formal post-mortem and loss total.
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/alexlab-self-listing-2025