Bunni Protocol
Summary
Bunni Protocol is a Uniswap liquidity-incentive layer developed by Timeless Finance that evolved from a Uniswap v3 LP-token wrapper (v1) to a full DEX built on Uniswap v4 hooks (v2). On September 2, 2025, Bunni v2 suffered an $8.4 million flash-loan exploit caused by a rounding-direction vulnerability in its withdrawal mechanism — a class of issue that multiple auditors had flagged in advance. The team announced permanent shutdown in October 2025, citing the inability to fund the six-to-seven-figure re-audit required for a secure relaunch.
Connected Entities
1 entities · 10 linked investigationsTimeline(10 events)
2022-01-01
Bunni v1 launches on Ethereum, wrapping Uniswap v3 LP NFTs into fungible ERC-20 tokens and introducing the LIT/veLIT gauge-and-bribe system.
Bunni Docs2024-08-01
Pashov Audit Group completes a Bunni v2 security review, identifying 45 issues including 6 critical findings.
Pashov Audits GitHub2025-01-01
Trail of Bits audit flags rounding and arithmetic concerns (TOB-BUNNI-13) and excess-liquidity manipulation (TOB-BUNNI-9), recommending improved rounding logic and fuzz-testing coverage.
Rekt News — Bunni Rekt2025-02-01
Bunni v2 launches on Ethereum Mainnet, Base, and Arbitrum as the first DEX built on Uniswap v4 hooks.
Bunni X announcement2025-06-01
Cyfrin audit identifies 50+ issues and warns that 'complex bugs still present' are statistically likely, advising against further scaling without additional security work. TVL surges from $2.4M to $23.9M immediately after publication.
CryptoNews2025-09-02
Flash-loan exploit drains $8.4M from Bunni v2 USDC/USDT pool (Ethereum, $2.4M) and weETH/ETH pool (Unichain, $5.9M) via a rounding-direction vulnerability in BunniHubLogic::withdraw(). Attacker wallets were funded through Tornado Cash.
QuillAudits2025-09-02
Bunni team pauses all smart-contract functions within two hours of initial exploit alerts and assembles a security war room. An on-chain message offers the attacker a 10% white-hat bounty; it goes unanswered.
Halborn2025-10-10
Bunni team announces permanent shutdown on X, citing inability to fund a six-to-seven-figure secure relaunch. TVL has declined from $50.8M to $1.3M since the exploit.
CoinDesk2025-10-23
CoinDesk reports on the Bunni shutdown. The team confirms remaining treasury will be distributed to token holders (excluding team), v2 contracts relicensed to MIT, and cooperation with law enforcement is ongoing.
CoinDeskDecision Log
- hash: C7JNA9GKbYdEemoBPMbFR9DBup4295hwZC5U6DSz9Qjg
- hash: D3QstFazWnDF1jYQKdtTbrGdtrrAhZXxvznqBsMkxtSA
- hash: 8CdRtwmxrDge8cjh4ckgjgAHTo9GHCL9SiYrv2yfYAwt
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/1/2026, 5:47:15 PM
last updated: 6/8/2026, 2:49:36 AM
avoid.net — verified advice for a post-truth world