Rekt - ArcadiaFi

ArcadiaFi, a DeFi lending protocol on Base, lost about $3.6 million on July 14-15 through a flaw in its rebalancer contract, according to the article's account. The article says the attacker used three Morpho flashloans worth about $1.5 billion and that the unchecked router.call(data) in SwapLogic._swapViaRouter() let them drain victim accounts after repaying their debt. It states that Pashov Auditing Group had flagged the missing input validation but closed the issue as unexploitable, and that Trust Security, Sherlock and Renascence Labs audits did not cover the Rebalancer.