An Arrakis Finance V1 liquidity vault on Ethereum was exploited for approximately 2.94 WETH, or around $7,000 at the time, after an attacker manipulated the state of an ENS-WETH Uniswap V3 position within a single transaction. The incident affected a legacy G-UNI vault rather than Arrakis Finance’s current V3 infrastructure, significantly limiting the scope of the event.
On-chain records identify the affected ENS-WETH vault on Etherscan. Security researchers traced the August 23 exploit to a permissionless atomic strategy involving a flash loan, temporary manipulation of the underlying Uniswap V3 pool and rapid minting and burning of vault shares. No administrator credentials or other privileged protocol access were required to execute the transaction.
Atomic Transaction Exploits V1 Accounting Behavior
Security analysis indicates that the attacker borrowed roughly 1,800 WETH through Morpho, temporarily changed the composition and price state of the ENS-WETH pool and interacted with the vault’s minting mechanism. The pool state was then changed again before the attacker burned the newly created shares and converted the resulting surplus. The full sequence was executed atomically, allowing different vault states to be exploited before the transaction reached final settlement.
The technical issue is more nuanced than a simple oracle attack. SlowMist characterized the root cause as state-dependent Uniswap V3 mint-and-burn accounting without sufficient same-transaction protection or a fixed state snapshot. The attacker was able to mint shares under one pool composition and redeem them after the position state had changed, extracting approximately 2.94 WETH in the process.
Arrakis V1, originally known as G-UNI, was designed as a tokenized concentrated-liquidity wrapper for Uniswap V3. Its legacy documentation confirms that the vault exposes mint and liquidity-removal functions around managed positions. The exploited mechanism belongs to an architecture launched in 2021 and subsequently superseded by newer generations of Arrakis liquidity-management infrastructure.
V1 Was Already Deprecated Before the Exploit
The most important context is that Arrakis had formally deprecated V1 and V2 more than two months before the incident. In its June 15 deprecation notice, Arrakis said all privileged roles had been renounced and ownership transferred to the zero address. The company explicitly warned that V1 would receive no further monitoring, bug fixes, security patches or operational intervention.
That decision also means the legacy contracts cannot simply be patched following the latest exploit. Arrakis states that no party retains authority to upgrade, pause or reconfigure V1 and advises remaining users to withdraw rather than add new liquidity. The incident therefore exposes risk in an immutable, unsupported legacy deployment rather than demonstrating a newly discovered vulnerability in actively maintained Arrakis V3.
The limited financial impact keeps the event far below the scale of major DeFi breaches, but the mechanics remain instructive. Automated liquidity vaults can be exposed when share accounting depends on mutable pool conditions that an attacker can alter and exploit inside one atomic transaction, particularly when legacy contracts can no longer be upgraded after vulnerabilities emerge.