Ocean Protocol's mOCEAN token drained via logic error in asymmetric liquidity pool math across ~70 BPool/SideStaking pools on Polygon.
Security & Exploits ·
Ocean Protocol's mOCEAN token experienced a loss of approximately $11.9K on Polygon after an attacker drained roughly 127.86K mOCEAN across ~70 BPool and SideStaking pools. The exploit occurred on 2026-06-25, with mOCEAN trading at $0.0928 at the time.
The attack exploited a logic error in the pool's asymmetric liquidity math. The attacker used a flash-swapped mOCEAN balance to repeatedly call BPool.joinswapExternAmountIn, which triggered the SideStaking bot to auto-mirror datatokens. By then cascading BPool.exitswapPoolAmountIn calls, the attacker exposed a mismatch between the deposit calculation (calcPoolOutGivenSingleIn) and exit calculation (calcSingleOutGivenPoolIn). The SideStaking auto co-staking and unstaking amplified this discrepancy, allowing each cycle to redeem more mOCEAN than deposited and systematically draining each pool's base-token reserve.
The specific transaction and attacker address are traceable on-chain, though it remains unclear whether the protocol team has implemented fixes across all affected pools or whether further recovery or remediation is underway.