What happened
On June 22, 2024, Maya Protocol, a platform providing a liquidity pool for the CACAO token, fell victim to an attack that resulted in the attacker withdrawing about 1.7 million USD. The hacker exploited a vulnerability in the subsidy mechanism, forcing the contract to "pay" a non‑existent reward, and then repeatedly added and removed liquidity, gaining access to pool providers' funds. According to the audit firm CertiK, the direct financial damage amounted to $1 730 000, and indirect losses affected all holders of CACAO and LP tokens.
Why this matters for the crypto market
The exploit reveals a fundamental vulnerability in the incentive model of DeFi protocols, where automatic subsidies are often implemented without robust access control. The loss of such a significant amount of funds undermines investor confidence in new projects, especially those offering "interest‑free" yields from farming. For traders, it is a signal to exercise heightened caution when dealing with obscure pools: the volatility spike of CACAO after the incident led to a sharp price drop of more than 30 % within a day, and trading volume fell by 45 %. For developers and auditors, the event serves as a reminder of the need to integrate MEV protection and stricter checks on subsidy orchestration. Investors focused on long‑term TVL may reassess their portfolios, reallocating capital to more vetted protocols, which in the short term will reduce the overall liquidity volume in the ecosystem.
Technical breakdown of the incident
The attack consisted of four consecutive steps:
- Subsidy manipulation. The protocol used the function
grantSubsidy(address recipient, uint256 amount), which only verified the contract owner's signature but did not check the availability of funds on the balance. The hacker crafted a fake request, specifying the address of a "zero" token, which resulted in the "issuance" of a subsidy of 0 ETH, but with a subsequent state change. - Re‑entrancy exploitation. After the subsidy was confirmed, the attacker called the function
addLiquidity(), which internally invoked an external price‑calculation library. The lack of "checks‑effects‑interactions" allowed re‑callingaddLiquiditybefore the first transaction completed, thereby increasing their participation in the pool without proper balance updates. - Flash‑loan absorption. Using Uniswap V3 as a source of instant credit, the attacker borrowed $500 k, which gave them the ability to meet the minimum required for adding liquidity and simultaneously trigger a price shift that amplified profit from the subsequent withdrawal.
- Series of removeLiquidity operations. After the pool was "filled" with dummy tokens, the attacker called
removeLiquidity()multiple times, obtaining a real share of assets, including CACAO and WETH, which were then transferred to a hidden address.
The key shortcoming – the lack of multisig verification for functions that modify subsidy parameters, as well as the absence of limits on the frequency of addLiquidity calls. Additionally, the contract did not use an oracle‑guard to protect against price manipulations, which allowed the flash‑loan attack to alter the pool's internal price in the attacker's favor.
Risks and opportunities for Web3 business
- Hidden risk — opaque subsidies. Automatic payouts without external verification can become a vector for repeat attacks.
- Hidden risk — lack of multisig control. A single key administrator can alter financial logic without consensus.
- Hidden risk — insufficient MEV protection. Protocols without a built‑in front‑running barrier are vulnerable to price manipulations through flash‑loans.
- Opportunity — escrow module integration. Using conditional deposits allows "delaying" subsidies until the availability of funds is confirmed.
- Opportunity — isolated API gateways. Separating management logic from user access reduces the attack surface.
- Opportunity — real‑time audit platforms. Automated monitoring of anomalies in liquidity volumes and function call frequency can alert before funds are withdrawn.
How to protect yourself and capitalize on this trend
Mint Scripts Studio offers a set of proven architectural solutions that minimize the likelihood of similar exploits recurring:
- no‑backdoors. Every smart contract undergoes a thorough audit and contains no "hidden" functions callable only by the owner.
- clean open source. A full public repository allows the community to review logic and suggest improvements, reducing the risk of hidden vulnerabilities.
- isolated API gateways. External requests to financial methods pass through a separate layer where rate‑limiting and whitelist‑control are implemented.
- escrow logic. Subsidies and payouts are held in a conditional deposit until the balance is verified and the absence of conflicts is confirmed.
- multisig authorization. Critical operations, such as changing subsidy parameters or withdrawing funds from the pool, require signatures from at least two independent participants.
- MEV‑protection. Built‑in front‑running protection mechanisms (commit‑reveal, time‑lock) make instant price attacks impossible.
For developers looking to monetize the growing demand for security, it is recommended to offer audit and DeFi protocol enhancement services as modular packages. Partnership programs with exchanges allow earning commissions for integrating our escrow modules, as well as for training teams on smart‑contract security best practices. Investors can diversify their portfolios by investing in projects that have passed our security‑seal, while also receiving bonus tokens for participating in bounty programs.