Seneca Protocol
Summary
Seneca Protocol is an omnichain CDP (collateralized debt position) protocol deployed on Ethereum mainnet and Arbitrum that allowed users to borrow a stablecoin (senUSD) against yield-bearing collateral assets. On February 28, 2024, a critical arbitrary external-call vulnerability in the protocol's Chamber contract was exploited, resulting in approximately $6.4 million in user funds being drained. Roughly 80% of stolen funds were returned after an on-chain negotiation, but a net loss of approximately $1.28 million remained, and evidence surfaced that the vulnerability had been reported to the team prior to launch.
Connected Entities
1 entities · 10 linked investigationsTimeline(8 events)
2023-11-01
Seneca Protocol abandoned a competitive audit contest on Sherlock approximately five days before its planned launch, with the team reportedly describing the code as 'battle-tested.'
Rekt News2023-11-01
X user 'cawfree' allegedly warned Seneca of the exact performOperations vulnerability and was subsequently blocked by the team. Security researcher Daniel Von Fange also allegedly identified the bug and was removed from the project's Discord.
Protos2023-11-08
Seneca Protocol launched on Arbitrum, partnering with CamelotDEX to seed primary liquidity pools.
Seneca (@SenecaUSD) on X2024-02-28
Attacker (funded via FixedFloat approximately five months prior) exploited the Chamber contract's performOperations function, draining approximately $6.4 million (1,900+ ETH) from users across Ethereum mainnet and Arbitrum using crafted transferFrom calls.
The Block2024-02-28
PeckShield Inc. publicly flagged the attack on-chain. Seneca team confirmed the exploit and instructed users via @SenecaUSD to revoke approvals for affected Chamber contract addresses on Ethereum and Arbitrum.
Seneca on X2024-02-29
Seneca published an on-chain message offering the attacker a 20% bounty (~$1.28M) to return 80% of stolen funds and indicating legal action would not be pursued if funds were returned.
CryptoPotato2024-02-29
Attacker returned approximately 1,537 ETH (~$5.3 million) to Seneca's Gnosis Safe address, retaining approximately 300 ETH (~$1.04 million) as bounty across two new addresses.
CoinTelegraph2024-03-01
Seneca published an official post-mortem on Mirror, apologizing to the community, confirming 80% fund recovery, and committing to a user reimbursement plan and protocol security improvements.
Seneca Exploit — Post Mortem (Mirror)Decision Log
- hash: GyCr243MuRQ8hiiyK8PXLTVE2rQts2SxsbhXkK4aYbgq
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/1/2026, 5:49:11 PM
last updated: 6/1/2026, 5:49:15 PM
avoid.net — verified advice for a post-truth world