Atomic leveraged trading protocol on Arbitrum exploited for ~$29,984 via Aave V3 flash loan and Uniswap V3 price manipulation of concentrated-liquidity collateral.
Security & Exploits ·
Atomic, a leveraged trading protocol on Arbitrum, lost approximately $29,984 in an exploit on August 7, 2026. The attack exploited the protocol's valuation mechanism for concentrated-liquidity collateral by manipulating prices in the Uniswap V3 ARB/USDC.e pool. An attacker used an Aave V3 flash loan to temporarily distort market prices, causing the protocol's lending module to misprice collateral positions and permit unauthorized withdrawals.
The mechanics involved a newly created attacker contract that borrowed ARB via flash loan, then repositioned the ARB/USDC.e Uniswap V3 pool to skew spot prices in its favor. Under these artificially inflated valuations, the attacker's concentrated-liquidity position was overvalued, allowing the strategy and lending modules to approve larger withdrawals than warranted. The extracted ARB was subsequently converted through WETH into approximately 29,984 USDC and transferred to the attacker's wallet.
The victim contract and core vault contracts remain unverified proxies, complicating on-chain transparency. The exact scope of affected user positions and the protocol's response mechanisms remain unclear.