Bunni Protocol
Last changed 2026-10-14 · Re-researched — Re-researched in full by the investigator agent; the text was rewritten from new research. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2UNup3…YjZ8Summary
Bunni Protocol (Bunni v1 and Bunni v2) was a Uniswap liquidity-incentive and decentralized exchange project developed by Timeless Finance, led pseudonymously by Zefram Lou. On 1-2 September 2025 an attacker drained approximately $8.4 million from two Bunni v2 pools by exploiting a rounding-direction flaw in the withdrawal logic, a class of issue that auditors had flagged beforehand. The team announced a permanent shutdown in October 2025, citing the cost of a secure relaunch, and no recovery of the stolen funds has been publicly confirmed.
Connected Entities
8 entities · 60 linked investigations- Across Protocol→mentioned with→Arbitrum(60%)
- Across Protocol→mentioned with→Ethereum(70%)
- Bunni Protocol→mentioned with→Uniswap(80%)
- Bunni Protocol→mentioned with→Arbitrum(65%)
- Bunni Protocol→mentioned with→Ethereum(80%)
- Bunni Protocol→mentioned with→Balancer(60%)
- Bunni Protocol→mentioned with→Base(65%)
- Balancer→mentioned with→Arbitrum(60%)
- Balancer→mentioned with→Ethereum(70%)
- Uniswap→mentioned with→Ethereum(80%)
- + 8 more
Timeline(11 events)
2022
Bunni v1 launches on Ethereum, wrapping Uniswap v3 LP NFTs into fungible ERC-20 tokens and introducing the LIT/veLIT gauge-and-bribe system.
Bunni DocsAugust 2024
Pashov Audit Group completes a Bunni v2 security review, identifying 45 issues including 6 critical findings.
Pashov Audits GitHub2025
Trail of Bits audit (January 2025) flags rounding and arithmetic concerns (TOB-BUNNI-13) and excess-liquidity manipulation (TOB-BUNNI-9), recommending improved rounding logic and fuzz-testing coverage.
Rekt NewsFebruary 2025
Bunni v2 launches on Ethereum Mainnet, Base and Arbitrum as the first DEX built on Uniswap v4 hooks.
Bunni X announcementJune 2025
Cyfrin's main audit identifies 50+ issues and warns that more complex bugs are statistically likely, advising a follow-up audit before deploying significant capital.
CryptoNewsJuly 2025
TVL surges from $2.4M to $23.9M following publication of the Cyfrin audit (31 July-1 August 2025 per one account); a limited-scope Cyfrin review of the Fee Hooklet in July excludes withdrawal logic.
Rekt NewsSeptember 2025
1-2 September 2025: flash-loan exploit drains about $8.4M from the Bunni v2 USDC/USDT pool (Ethereum) and weETH/ETH pool (Unichain) via a rounding-direction flaw in BunniHubLogic::withdraw(); attacker wallets funded through Tornado Cash.
QuillAuditsSeptember 2025
Bunni pauses all smart-contract functions about two hours after the first alerts, confirms only two pools were affected, and sends an on-chain message offering the attacker a 10% bounty, which is not accepted.
HalbornOctober 2025
10 October 2025 (per one account): Bunni team announces permanent shutdown on X, citing inability to fund a six-to-seven-figure secure relaunch; TVL has fallen from $50.8M to $1.3M.
CoinDeskOctober 2025
23 October 2025: CoinDesk reports the shutdown; the team confirms remaining treasury will go to token holders (excluding team), v2 contracts are relicensed to MIT and open-sourced, and law-enforcement cooperation is ongoing (another account dates the shutdown announcement itself to this day).
CoinDeskDecision Log
- slot 445607774 · hash 7bU5kZ68KzxQV1hDfgLbfxVvvTHyN2zDMgG3iHYbyAQv
- slot 425023544 · hash C7JNA9GKbYdEemoBPMbFR9DBup4295hwZC5U6DSz9Qjg
- slot 425023541 · hash D3QstFazWnDF1jYQKdtTbrGdtrrAhZXxvznqBsMkxtSA
- slot 423640159 · hash 8CdRtwmxrDge8cjh4ckgjgAHTo9GHCL9SiYrv2yfYAwt
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 29 of 34 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 6/1/2026, 5:47:15 PM
last updated: 10/14/2026, 12:24:19 AM
12 viewsavoid.net — verified advice for a post-truth world