Bunni protocol suffers from suspicious ETH transactions with $2.3 million flag

Table of Contents

The Bunni protocol is a Defi system based on Ethereum. It is said that it lost around $2.3 million in a suspicious transaction monitored by leading blockchain security scanner BlockSec Phalcon. Although details of this exploit are unknown, the flagged activity appears to indicate that there was unauthorized access that could have led to this. To be precise, you acquire smart contracts or unpatched vulnerabilities.

What is the Bunni protocol?

Bunni is an ERC-20 solid that wraps and trades UNISWAP V3 Liquidity Provider (LP) NFTs, making trading and managing complex UNISWAP V3 positions easier. Its design is considered simple, with previous security audits (Yaudit, August 2022) detecting a relatively small number of attack surfaces. Nevertheless, the peripheral payment contract, or Sweeptoken() function, does not have access control and can be used by anyone to transfer tokens from Bunnihub. It is not clear if this bug was fixed prior to this week’s exploit, but it could be connected to the loss.

The role of block sec falcon

The Phalcon platform provided by BlockSec focuses on real-time identification of malicious blockchain transactions by scanning Mempool transactions and chain data. We have a proven track record of saving your Defi projects from significant losses. This was done by implementing immediate alerts and fast response measurements. In this example, Falcon quickly raised the red flag in a deal suspected of having a viral bunny.

Market and Community Impact

The price of Bunni tokens and the reliability of liquidity pools is extremely unstable as this exploit (2.3 million) is instantly magnitude. Similarly, Ethereum’s security procedures are under even more scrutiny, especially as Defi still suffers from sophisticated smart contract interactions.

The Community Forum indicates that the developer is assessing the damages and indicates that there will be a possible patch or outage of the contract. The next 24-48 hours will play a key role in determining whether you can get your money back or put it in your exploit pocket.