QUADRIGA INITIATIVE
CRYPTO WATCHDOG & FRAUD RECOVERY PLATFORM
A COMMUNITY-BASED, NOT-FOR-PROFIT
$458 000 USD
NOVEMBER 2024
GLOBAL
CLIPPER EXCHANGE
DESCRIPTION OF EVENTS

Clipper is a decentralized exchange (DEX) designed to provide liquidity providers (LPs) with concentrated liquidity and protection from common issues like impermanent loss, MEV (Miner Extractable Value) bots, and sandwich attacks. By offering up to 100x concentrated liquidity around market prices and using rapid rebalancing, Clipper amplifies returns for LPs while maintaining firm pricing. It leverages a unique architecture that enables better yields and more secure trading for liquidity providers. The platform is permissionless and designed for professionals, allowing users to participate in DeFi with minimal risk. Clipper also features the SAIL token, which rewards LPs and is part of the governance of the AdmiralDAO. The exchange has facilitated billions in trading volume and supports a growing community of users.
"Small pools allowed for imbalances and exploitation: Low balances and low k values combined with low transaction costs on L2s made pools more vulnerable to manipulation. Base and Optimism were the two smallest pools, and Optimism had a 5x lower k value than any other chain. As a result, the Optimism and Base pools were more vulnerable. Protections built to prevent malicious swaps were not applied to single-asset deposits/withdrawals (which include a swap). Lack of On-Chain Validation: Clipper's smart contracts validate pool invariants and check for significant state changes during execution of normal swaps, but that was not customary on single-asset withdrawals because of an additional fee that mitigated arbitrage in the past. API Limitations: The API endpoints have mechanisms to detect abnormal request patterns and prevent misuse for normal swaps (e.g. thousands of swaps from similar sources and wallets that have characteristics of bots), but that was not customary on single-asset withdrawals because of an additional fee that mitigated arbitrage in the past. Recent updates introduced a bug in Clipper's Circuit-breaker: Clipper includes an off-chain circuit-breaker as an added safeguard to pause swaps in the event of significant balance changes in the pools. A recent database upgrade, implemented to enable the future possibility to support multiple pools on each chain, introduced an unexpected interaction with the circuit-breaker logic that had not been detected in the testing environment. This has since been addressed."
$457,878 from postmortem.
The exploit was detected and responded to swiftly by AdmiralDAO, who paused the API and initiated an investigation. The vulnerability was linked to low pool balances and the absence of protections on single-asset withdrawals. In response, Clipper is implementing contract enhancements, improved API security, and circuit-breaker systems to prevent future exploits.
Clipper is implementing several remediation actions to address the vulnerability and prevent future exploits. First, they will enhance their smart contracts by adding on-chain validations to ensure that pool invariants remain consistent during single-asset withdrawals, similar to existing protections for swaps. They also plan to integrate price oracles to validate asset values on deposits and withdrawals, and consider introducing a short lockup period for new deposits to prevent manipulation.
In terms of API and backend security, Clipper will extend its circuit-breaker system to automatically halt deposit and withdrawal actions if abnormal behavior is detected in the pools. Additionally, they will improve behavioral monitoring to detect bot-like activity and abnormal API usage, applying similar protections already in place for normal swaps. Safeguards will also be introduced for configurations like the k parameter, expiration times for signatures, and deposit lock times, along with a dashboard to allow contributors to review and discuss API settings.
Clipper is also considering proactive monitoring to detect suspicious on-chain behavior, which could provide early warnings and potentially prevent future attacks. Finally, AdmiralDAO is engaging ZeroShadow, an incident response firm, to trace and recover the compromised funds.
"A tracing and recovery firm has been retained (Zeroshadow). Once the potential for recovery is assessed, methods to finance a refund will be considered. To clarify, there are no guarantees at this time, but neither has the issue been discussed. One thing at a time."
"The winds of fortune have shifted—104 ETH has been returned to our treasure chest by the scallywag behind the recent exploit! The crew is now plotting the best course for refunds to ensure fairness for all affected mates. Stay anchored—we’ll share updates soon!"
Funds are being traced and recovery efforts are underway. Clipper is also planning to re-enable trading once remediations and security reviews are complete.
"I sincerely apologize for the delay due to personal health issues. I'd like to return the entire amount (104 ETH) I took, though it is a bit late. As far as I know, there are no longer any vulnerabilities in the contract. I wish for the continued growth and success of your community."
"The crew is now plotting the best course for refunds to ensure fairness for all affected mates. Stay anchored—we’ll share updates soon!"
Clipper is a decentralized exchange (DEX) designed to provide liquidity providers (LPs) with concentrated liquidity and protection from common issues like impermanent loss, MEV (Miner Extractable Value) bots, and sandwich attacks. On December 1, 2024, an attacker exploited a vulnerability in Clipper's smart contracts, manipulating the single-asset deposit and withdrawal feature to exploit liquidity pools on the Optimism and Base networks. By performing swaps to manipulate pool balances, the attacker obtained more assets than they deposited, causing a loss of approximately $457,878. The attack was promptly mitigated by the AdmiralDAO, securing remaining funds and halting further activity while initiating an investigation and engaging security firms for recovery efforts. It does no
Clipper Dec 24 Exploit Post-Mortem (Jan 20)
OP Mainnet Transaction Hash (Txhash) Details | OP Mainnet Etherscan
(Jan 20)
@Clipper_DEX Twitter (Jan 20)
@Clipper_DEX Twitter (Jan 20)
@Clipper_DEX Twitter (Jan 20)
@Clipper_DEX Twitter (Jan 20)
@Clipper_DEX Twitter (Jan 20)
@Clipper_DEX Twitter (Jan 20)
@Clipper_DEX Twitter (Jan 20)
@Clipper_DEX Twitter (Jan 20)
@Clipper_DEX Twitter (Jan 20)
@Clipper_DEX Twitter (Jan 20)
@Clipper_DEX Twitter (Jan 20)
