Seneca Hack

Seneca is a stablecoin protocol on Ethereum and Arbitrum where users deposit collateral, such as liquid staking tokens, to borrow its senUSD stablecoin. It had launched only about two months before the attack. Users approved Seneca's collateral vaults, called Chambers, to move these tokens. On 28 February 2024, an attacker found that the Chambers would carry out almost any instruction a caller gave them without checking it. This let the attacker make the Chambers transfer approved tokens out of users' wallets and into the attacker's own address.

The attacker took about $6.4M, much of it in ETH-based liquid staking tokens. Seneca could not pause the contracts, so it warned users to revoke their approvals and posted an on-chain message offering the attacker a 20% bounty. The next day, the attacker returned 1,537 ETH, roughly 80% of the stolen funds, to a Seneca recovery wallet and kept around $1.3M. Seneca then paid the recovered funds out to affected users at about that same 80% rate. Funds deposited into Seneca itself were not affected.

The Chamber contracts cannot be upgraded, were never paused and no longer have an owner, so nobody can disable them. That means any approval still given to a Chamber can be abused in exactly the same way today. If you ever used Seneca on Ethereum or Arbitrum, revoke all approvals to its contracts now. The Chambers had been audited by Halborn before launch, which is a reminder that audits reduce risk but cannot guarantee a contract is safe.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.