A NullMeridian record Andromeda Logs

NullMeridianLog

2 Sep 2025

Bunni: Idle-Balance Rounding Across Tiny Withdrawals Enabled Sandwich

Bunni: on 2 Sep 2025 ~$8.4M was taken from weETH/ETH (Unichain) and USDC/USDT (Ethereum) via flash-loan swaps plus tiny withdrawals that skewed liquidity estimates.

  • Event date
  • Incident typeSmart-contract exploit
  • Bug classAccounting
  • Published

Loss, as sourced

About $8.4m, per Bunni. Two pools affected.

Traceability

Primary sources

  1. 01blog.bunni.xyzBunni Exploit Post Mortem, 4 Sep 2025 (opens in a new tab)

In brief

Root cause: Per Bunni: withdraw idle-balance mulDiv rounded down; repeated tiny withdrawals disproportionately cut active liquidity; attacker sandwiched the rebound. Fix: mulDivUp.

Timeline, as sourced: 2 Sep exploit; 4 Sep post-mortem; withdrawals unpaused; deposits/swaps remain paused.

Account, as sourced

Claimed (Bunni) (post-mortem (opens in a new tab)): Unichain USDC/USD₮0 spared by insufficient flashloan liquidity.

Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.

Permalinkhttps://andromeda.observer/e/bunni-idle-balance-rounding-2025