Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3YtD1T…ZNVZSummary
Bunni V2 was a decentralized exchange and liquidity layer built on Uniswap v4, developed by Timeless Finance. On September 1-2, 2025, the protocol suffered a critical exploit draining approximately $8.4 million across Ethereum and Unichain through a rounding-direction vulnerability in its withdrawal mechanism. The team permanently shut down the protocol on October 23, 2025, citing inability to finance a secure relaunch after the exploit erased 97% of TVL.
Connected Entities
4 entities · 60 linked investigations- Across Protocol→mentioned with→Ethereum(70%)
- Uniswap→mentioned with→Ethereum(80%)
- Bunni V2→mentioned with→Ethereum(80%)
- Bunni V2→mentioned with→Across Protocol(80%)
- Bunni V2→mentioned with→Uniswap(80%)
Timeline(10 events)
August 2024
Pashov Audit Group conducts security review of Bunni V2, identifying 45 issues including 6 critical findings.
2025
Trail of Bits completes audit of Bunni V2, explicitly flagging rounding and arithmetic error risks (findings TOB-BUNNI-13 and TOB-BUNNI-9) and recommending additional fuzzing.
June 2025
Cyfrin completes main audit of Bunni V2, identifying 50+ issues and recommending against deploying significant capital without a follow-up audit and stateful fuzzing suite.
31 July 2025
TVL surges from $2.4 million to $23.9 million immediately following publication of Cyfrin's audit, despite explicit warnings against scaling.
19 August 2025
Bunni V2 TVL reaches peak of approximately $80 million.
September 2025
Exploit begins. Attacker (primary address: 0x0C3d8fA7762Ca5225260039ab2d3990C035B458D) drains USDC/USDT pool on Ethereum (~$2.4M) and ETH/weETH pool on Unichain (~$6M) via rounding vulnerability in BunniHubLogic::withdraw(). BlockSec alerts the team; CertiK identifies the Unichain component approximately one hour later.
September 2025
Bunni pauses all smart contract functions approximately two hours after the initial BlockSec alert. Stolen ETH begins bridging from Unichain to Ethereum via Across Protocol in 100 ETH increments.
2 September 2025
Bunni confirms only two pools were compromised. Team offers attacker a 10% recovery bounty; offer is rejected. Stolen funds traced to Tornado Cash-funded wallets, preventing identity attribution.
23 October 2025
Bunni announces permanent shutdown. Team cites inability to afford 'six to seven figures' in relaunch costs. TVL had fallen 97.44% from $50.82M to $1.3M in the intervening month.
23 October 2025
Bunni open-sources V2 smart contracts under MIT license. Team states it will distribute approximately $2 million in remaining treasury to BUNNI, LIT, and veBUNNI token holders (excluding team).
Decision Log
- hash: 9zeFfcifXdzT74eoe18XyVPNrsipaQ4ju9NgN1jEmENK
This investigation is cryptographically anchored to the Solana blockchain (1 event). 18 of 19 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:15 AM
last updated: 8/30/2026, 7:44:37 AM
6 viewsavoid.net — verified advice for a post-truth world