A NullMeridian record Andromeda Logs

NullMeridianLog

15 Jul 2025

Arcadia Finance: Unvalidated Rebalancer Calldata Drained Accounts

Arcadia on Base: on 15 Jul 2025 unvalidated swap/calldata in the Rebalancer path let an attacker abuse trusted rebalancer permissions. ~$3.5–3.6M per security firms.

  • Event date
  • Incident typeSmart-contract exploit
  • Bug classValidation
  • Published

Loss, as sourced

About $3.5–3.6 million on Base, per CertiK and Veridise.

Traceability

Primary sources

  1. 01certik.comCertiK Arcadia Incident Analysis (opens in a new tab)
  2. 02veridise.comVeridise analysis (opens in a new tab)

In brief

Root cause: Per CertiK/Veridise: unvalidated swapData/calldata in Rebalancer flow enabled arbitrary actions under trusted permissions.

Timeline, as sourced: 15 Jul 2025 on Base.

Account, as sourced

Per CertiK (analysis (opens in a new tab)): arbitrary swapData root cause.

Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.

Permalinkhttps://andromeda.observer/e/arcadia-rebalancer-calldata-2025