Xocolatl.finance exploited for $8.3K via unvalidated houseOfReserve parameter in liquidation function, allowing attacker to claim collateral from 12+ users without repaying debt.
Security & Exploits ·
Xocolatl.finance, a protocol by LaDAO_Club, lost approximately $8.3K on March 24 following an exploit of its liquidation mechanism. The attacker executed 74 liquidation calls against 12 or more users, draining roughly 3.25 cbETH and 0.216 WETH from two HouseOfReserve vaults without repaying any debt.
The vulnerability resided in the AccountLiquidator.liquidateUser() function, which accepted an arbitrary address as the houseOfReserve parameter without validating that it was a registered reserve contract. The attacker deployed a fraudulent HouseOfReserve contract that returned the legitimate reserveTokenID—enabling it to claim victims' collateral—while returning a fake backedTokenID that reported zero debt. This mismatch resulted in a zero cost of liquidation while leaving the collateral penalty balance intact, permitting seizure of collateral without requiring debt repayment.
The affected AccountLiquidator contract remains on-chain, and the project's code repository is publicly accessible. No information has been disclosed regarding remediation steps, user compensation, or whether additional vulnerabilities exist in other liquidation or reserve management functions.