Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/alkimiyasilicapoolsuint128truncationunsafedowncasting.php}} {{Unattributed Sources}} AlkimiyaAlkimiya, a protocol for trading on real blockchain and macroeconomic metrics, was recently targeted in a sophisticated exploit due to an unsafe type cast (from uint256 to uint128) in its SilicaPools contract. The attacker used a flash loan to exploit this truncation..."

2025-08-27T21:34:02Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/alkimiyasilicapoolsuint128truncationunsafedowncasting.php}} {{Unattributed Sources}} thumb|AlkimiyaAlkimiya, a protocol for trading on real blockchain and macroeconomic metrics, was recently targeted in a sophisticated exploit due to an unsafe type cast (from uint256 to uint128) in its SilicaPools contract. The attacker used a flash loan to exploit this truncation..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/alkimiyasilicapoolsuint128truncationunsafedowncasting.php}}
{{Unattributed Sources}}

[[File:Alkimiya.jpg|thumb|Alkimiya]]Alkimiya, a protocol for trading on real blockchain and macroeconomic metrics, was recently targeted in a sophisticated exploit due to an unsafe type cast (from uint256 to uint128) in its SilicaPools contract. The attacker used a flash loan to exploit this truncation vulnerability, allowing them to mint and manipulate share records, ultimately redeeming more than their fair share of collateral. Although 1.14 WBTC (approx. $95.5K) was briefly compromised, a whitehat intervened to frontrun the malicious transaction, successfully recovering all funds. The Alkimiya team acted quickly to contain the issue, took affected systems offline, and is continuing its investigation into the attacker’s identity while reinforcing system security. No user funds were lost.<ref name="tenarmortweet-21011" /><ref name="etherscan1-21012" /><ref name="rotcivegaftweet-21013" /><ref name="etherscan2-21014" /><ref name="verichains-21015" /><ref name="leozayaattweet-21016" /><ref name="alkimiyatwitterx-21017" /><ref name="alkimiyahomepage-21018" /><ref name="alkimiyaintroduction-21019" />

== About Alkimiya ==
Alkimiya is a market protocol designed to trade on fundamental blockchain and macroeconomic metrics, rather than speculation or hype. It offers users the ability to create strategies around real economic indicators like blockspace demand, on-chain revenue, stablecoin supply, and more. These metrics are public, verifiable, and aim to be predictive of broader market trends.

At the core of Alkimiya is Forecast, its flagship product that transforms raw data into live, tradable markets. Forecast differs from typical binary prediction markets by offering continuous payoffs (more accurate predictions earn more), bounded risk (with caps and floors on outcomes), and a data-driven approach focused on measurable trends rather than volatile narratives like meme coins.

Users can trade on metrics such as BTC transaction fees, Ethereum base revenue, and USDC supply velocity, each supported by dedicated strategy handbooks. Launched in August 2024 and backed by top investors like Coinbase Ventures and Dragonfly, Alkimiya empowers traders, builders, and funds with tools to anticipate market movements through real-world data insights.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
A sophisticated exploit in Alkimiya’s SilicaPools contract—caused by unsafe downcasting allowed the compromise of 1.14 WBTC.
{| class="wikitable"
|+Key Event Timeline - Alkimiya SilicaPools uint128 Truncation Unsafe Downcasting
!Date
!Event
!Description
|-
|March 28th, 2025 9:34:47 AM MDT
|Attack Transaction Occurs
|The attack transaction is accepted by the Ethereum blockchain.
|-
|March 30th, 2025 9:42:00 AM MDT
|TenArmor Tweet Posted
|TenArmor posts a tweet with an analysis of the incident.
|-
|March 31st, 2025 1:08:00 AM MDT
|Leozayaat Tweet Posted
|Leozayaat, the founder of the project, posts an update with the outcome of the funds being returend.
|}

== Technical Details ==
The root cause of the exploit in the SilicaPools contract lies in the unsafe downcasting of the shares variable from uint256 to uint128 within the collateralizedMint function. The attacker exploited this truncation vulnerability by minting a massive number of shares—specifically, 2^128 + 1. While the full 256-bit value was accepted by the function, the internal logic only stored the lower 128 bits, effectively recording just 1 share instead of the full amount.

The attacker orchestrated the exploit using a flash loan of 10 WBTC, and then minted the large share amount by supplying around 1.7 WBTC as collateral. The system processed the full value of shares for minting, but due to the cast to uint128, only 1 share was officially recorded in the contract's state. After this, the attacker cleverly transferred most of the minted shares (2^128 - 1) away, leaving behind just 2 shares.

Later, the attacker called the redeemShort() function. This function checked the internal state, which believed only 1 share had been minted (due to the cast error), but saw that the attacker held 2 shares. Believing the attacker had over 100% of the supply, the contract allowed them to redeem the full value of the short position—about 3.4 WBTC, which was double the initial collateral.

Attacker address: 0xF6ffBa5cbF285824000daC0B9431032169672B6e

Attacker’s contract: 0x80bf7db69556d9521c03461978b8fc731dbbd4e4

Attack transaction: 0x9b9a6dd05526a8a4b40e5e1a74a25df6ecccae6ee7bf045911ad89a1dd3f0814

Vulnerable contract: 0xf3f84ce038442ae4c4dcb6a8ca8bacd7f28c9bde

== Total Amount Lost ==
TenArmor has estimated the amount lost at $95.5k USD.

The total amount lost has been estimated at $100,000 USD.

== Immediate Reactions ==
Upon detecting the exploit, the Alkimiya team acted swiftly by taking the affected systems offline, limiting the compromise to 1.14 WBTC. A known whitehat intervened to frontrun the malicious transaction, ensuring that all funds were ultimately recovered. The team expressed gratitude to @_SEAL_Org for their assistance, reaffirmed their commitment to decentralization and open-source development, and emphasized their determination to strengthen security while continuing to build an open financial system.

== Ultimate Outcome ==
All compromised funds were recovered and no user funds were lost. Although 1.14 WBTC was initially compromised, a whitehat hacker successfully frontran the malicious transaction, returning the funds. The Alkimiya team contained the threat quickly, took affected systems offline, and reinforced their commitment to security and decentralization going forward.

"This weekend Alkimiya was attacked by as of yet unknown hacker. Don't worry, all funds are safe.

This was a sophisticated exploit which necessitated intimate knowledge of our stack. It is obvious that whoever is responsible spent considerable time studying our systems. We quickly took the relevant parts of the system offline, and only 1.14 WBTC was compromised before further damage. Fortunately, a known whitehat frontran the malicious transaction. We are glad to say all funds have been returned.

We also want to give our most sincere and heartfelt thanks to @_SEAL_Org for springing to our aid and all the info they have been able to provide.

We always knew there are risks to decentralization and open source development. We will not be abandoning our core principles. Instead, we will work hard to ensure our systems are secure, continue to work with others in the space to share ideas and best practices, and above all we will double down on building the new and open financial system.

There are a lot of bad actors in this space, but as a result of this experience we are even more convinced that there are more good ones than bad ones, and that together we win."

== Total Amount Recovered ==
All compromised funds were recovered and no user funds were lost. Although 1.14 WBTC was initially compromised, a whitehat hacker successfully frontran the malicious transaction, returning the funds.

The total amount recovered has been estimated at $100,000 USD.

== Ongoing Developments ==
There remains an investigation into the identity of the attacker. The hacker remains unknown, and it’s clear they had intimate knowledge of Alkimiya’s system, suggesting a deeper breach of understanding or possible insider knowledge.

Root cause analysis, attacker identification, and long-term security hardening are still in progress.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="tenarmortweet-21011">[https://twitter.com/TenArmorAlert/status/1906371419807568119 TenArmor - "Yesterday's attack involving #Alkimiya @alkimiya_io on #ETH resulted in an approximate loss of $95.5K." - Twitter/X] (Accessed Aug 13, 2025)</ref>

<ref name="etherscan1-21012">[https://etherscan.io/tx/0x9b9a6dd05526a8a4b40e5e1a74a25df6ecccae6ee7bf045911ad89a1dd3f0814 Yoinked Attack Transaction - Etherscan] (Accessed Aug 13, 2025)</ref>

<ref name="rotcivegaftweet-21013">[https://twitter.com/rotcivegaf/status/1906574894013288747 Rotciv - "Origin attacker TX(reverted)" - Twitter/X] (Accessed Aug 13, 2025)</ref>

<ref name="etherscan2-21014">[https://etherscan.io/tx/0xc8875004a36cb97a40b9d9c8d1a56cf0d6042aec5eb330d17de7d70c8e13d7b4 Original Attack Transaction - Etherscan] (Accessed Aug 13, 2025)</ref>

<ref name="verichains-21015">[https://blog.verichains.io/p/alkimiya-hack-analysis Alkimiya Hack Analysis - VeriChains Blog] (Accessed Aug 13, 2025)</ref>

<ref name="leozayaattweet-21016">[https://twitter.com/Leozayaat/status/1906604421804589556 Leozayaat - "This weekend Alkimiya was attacked by as of yet unknown hacker. Don't worry, all funds are safe." - Twitter/X] (Accessed Aug 13, 2025)</ref>

<ref name="alkimiyatwitterx-21017">[https://twitter.com/alkimiya_io Alkimiya Twitter/X Account] (Accessed Aug 13, 2025)</ref>

<ref name="alkimiyahomepage-21018">[https://alkimiya.io/ Alkimiya Homepage] (Accessed Aug 13, 2025)</ref>

<ref name="alkimiyaintroduction-21019">[https://docs.alkimiya.io/docs/getting-started Introduction to Alkimiya - Alkimiya Documentation] (Accessed Aug 13, 2025)</ref></references>

Alkimiya SilicaPools uint128 Truncation Unsafe Downcasting - Revision history