Arcadia RebalancerSpot — Unvalidated `swapData` → Arbitrary `router.call`

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2025-07-ArcadiaRebalancer_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/ArcadiaRebalancer_exp.sol.

Vulnerability classes: vuln/input-validation/missing · vuln/dependency/unsafe-external-call · vuln/access-control/broken-logic · vuln/logic/missing-validation

Reproduction: isolated Foundry project at this project folder · full run log: output.txt. Verified source: sources/RebalancerSpot_C72921/ (critical line: src_rebalancers_libraries_SwapLogic.sol:140).

Key info#

Do not confuse with registry 2023-07-ArcadiaFi_exp (different year/class, Optimism).

TL;DR#

Arcadia’s RebalancerSpot is an Asset Manager for user Accounts. Initiators call rebalance(account, …, swapData). When swapData is non-empty, SwapLogic._swapViaRouter decodes an arbitrary router + data and does router.call(data) with no allowlist. Because msg.sender is the Rebalancer — already authorized as AssetManager on victim Accounts — the attacker can nest a flashAction against the victim Account inside that call, withdraw LP NFTs + ERC20s, and repay Morpho flash + debt from the loot.

Background#

Arcadia Accounts are composable margin vaults. Users optionally grant Asset Managers (rebalancers, compounders) permission to call flashAction, which can withdraw assets, run external logic, and redeposit — ending with a health check.

RebalancerSpot rebalances Uniswap V3 / Slipstream CL positions owned by an Account:

1. Initiator must be registered via setAccountInfo by the Account owner.
2. rebalance stores account, builds actionData (including swapData), calls IAccount(account).flashAction(address(this), actionData).
3. Account withdraws the LP NFT to the Rebalancer and calls executeAction.
4. Rebalancer burns liquidity, optionally swaps, mints a new range, returns deposit data.

The vulnerable code#

SwapLogic._swapViaRouter (verified multi-file source):

// sources/.../src_rebalancers_libraries_SwapLogic.sol
function _swapViaRouter(...) internal returns (uint256 balance0, uint256 balance1) {
    (address router, uint256 amountIn, bytes memory data) = abi.decode(swapData, (address, uint256, bytes));
    address tokenToSwap = zeroToOne ? position.token0 : position.token1;
    ERC20(tokenToSwap).safeApproveWithRetry(router, amountIn);
    (bool success, bytes memory result) = router.call(data); // ← unvalidated
    require(success, string(result));
    // ... refresh sqrtPrice + balances
}

Call chain (CertiK):

RebalancerSpot.rebalance()
  → AccountV1.flashAction(actionTarget=Rebalancer)
    → Rebalancer.executeAction() → SwapLogic._swap()
      → _swapViaRouter() → router.call(data)   // router & data from swapData

Neither router nor data is checked against a DEX allowlist.

Root cause#

Missing input validation on swapData combined with trusting msg.sender == Rebalancer as sufficient AssetManager auth on victim Accounts. The protocol assumed router would always be a DEX; the attacker made router the victim Account and data a privileged flashAction that drains it.

Preconditions#

1. Victim Account has already set RebalancerSpot as AssetManager (normal UX for rebalancing).
2. Attacker owns dummy Arcadia Accounts and registers self as initiator via setAccountInfo.
3. Attacker can flash-borrow enough to (a) mint a small LP “pretense” position and (b) repay victim debt so the post-flashAction health check on the victim passes after collateral is removed.
4. Initiator info (tolerance / fee / minLiquidityRatio) is set so rebalance mint checks can be satisfied (attacker donates leftovers for remint).

Attack walkthrough (primary tx / this PoC)#

From CertiK + QuillAudits + live calldata (start(...) selector 0x60ba0ee3 on 0x6250…4553):

1. Morpho flashloan — large WETH + cbBTC.
2. Wire dummy account — set Rebalancer as AssetManager; attacker as initiator; mint small Slipstream LP + deposit.
3. Repay victim debt — ~14.4 cbBTC on darcV2cbBTC for Account 0x9529… so health checks pass after theft (output.txt: victim USDC/AERO/USDS go 0 → empty).
4. rebalance(fakeAccount, …, swapData) — swapData decodes to router = victim, data = flashAction(...) withdrawing StakedSlipstream NFT + ERC20s to attacker.
5. Nested router.call runs as Rebalancer → victim flashAction succeeds (onlyAssetManager).
6. Attacker removes LP liquidity, swaps to WETH, repays flash; residual profit on attack contract.

PoC numbers (output.txt)#

Diagrams#

Remediation#

1. Allowlist routers in _swapViaRouter (Uniswap / Slipstream / 1inch only).
2. Reject router that is an Arcadia Account / AssetManager / self.
3. Do not grant AssetManager power that can be re-entered via untrusted external calls during rebalance.
4. Bound swapData length / selector allowlists for nested actions.

How to reproduce#

export PATH="$HOME/.foundry/bin:$PATH"
unset ETH_RPC_URL FOUNDRY_ETH_RPC_URL
cd 2025-07-ArcadiaRebalancer_exp
# Offline (anvil_state.json):
../../_shared/run_poc.sh 2025-07-ArcadiaRebalancer_exp -vv
# Or online archive:
# forge test --match-contract ArcadiaRebalancer -vv --gas-limit 50000000

Expected: [PASS] testExploit with ~197.72 WETH profit and victim ERC20s emptied.

Reference: CertiK Arcadia Incident Analysis · SolidityScan · QuillAudits · Cyvers

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2025-07-ArcadiaRebalancer_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: ArcadiaRebalancer_exp.sol.
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• DeFiHackLabs incident explorer: search "Arcadia RebalancerSpot".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.