Whalebit's $824K Loss and How Olympix Would Have Prevented It

Loss

Exploit date

March 31, 2026

Date: March 31, 2026

Chain: Polygon

Loss: about $824K, per Defimon

Class: staking valuation read from a pool's spot price

For most of March 31, 2026, Whalebit's CES token traded calmly on Polygon. CoinGecko's hourly data has it at about $1.08 at 22:00 UTC, in line with the rest of the day. By 23:00 UTC it was at about $0.74, and in the hour between, a single attacker had pulled about $824K out of the staking contract at the center of the Whalebit ecosystem, according to Defimon's alert.

The attack took less than a minute of block time. The staking contract decided what a CES deposit was worth by reading the spot price of an Algebra liquidity pool, the price implied by that pool's balances at that exact moment. A spot price can be pushed around within one transaction by anyone with enough tokens to trade, and the contract had no protection against that, so the attacker could make deposits look more valuable than they were and take the difference out of the staking pool.

A Gamified Economy Built on CES

Whalebit is the utility token of Meta Whale, which CoinGecko describes as an ecosystem of DeFi apps, GameFi platforms and NFT marketplaces built as a gamified universe on Polygon. CES is the token users hold and spend across those features, and staking it was one of the main ways to earn inside the system. A second Whalebit token, IGT, sat alongside it. According to Defimon's alert, the staking contract valued CES relative to IGT using the spot price of an Algebra pool, and on-chain the pool the attack traded through is Algebra's CES/USDT0 pool on Polygon.

The staking contract is an ERC1967 proxy at 0xb5ea...1868. Its proxy wrapper is verified on Blockscout, while the implementation behind it, 0xe37B...cCB2, isn't verified, which is why Defimon describes the staking contract as unverified. That means there's no public source to quote here, and the description of the flaw below comes from Defimon's analysis and the transactions themselves.

Why a Pool's Current Price Makes a Poor Valuation

An automated market maker sets its price from the ratio of the two tokens it holds. Buy a lot of CES from the pool and CES gets scarce inside it, so the pool's price for CES rises. Sell a lot back and it falls. That's exactly how a pool is supposed to work, and it means the pool's price at any one moment says what the last trade left behind, which isn't necessarily what CES is worth.

A contract that reads that moment's price to value deposits is trusting a number the depositor can move. If the depositor trades against the pool first, the contract sees the price they just created. Defimon calls the Whalebit staking contract vulnerable to classical oracle manipulation for this reason: its valuation could be shifted within a single block. The standard defenses all share one idea, that a valuation shouldn't come from a quantity the caller controls in the same transaction. Teams use a time-weighted average price that a single trade can't move much, an external price feed, or a check that rejects a deposit when the spot price strays too far from a reference.

The lesson for builders is the oldest one in DeFi pricing, and it keeps recurring because it's easy to miss when a pool happens to be the most convenient price on hand. Any value a contract pays out based on a price has to use a price the person being paid can't set.

One Minute, More Than a Hundred Transactions

The attacker's wallet, 0xe66b...5c6F, deployed its attack contract at 0xb5A8...faDf at 21:33:15 UTC. At 22:55:49 UTC it started calling that contract, and Blockscout shows 110 successful attack calls landing between 22:55:49 and 22:56:39 UTC. Defimon's alert cites one of them, 0x5d54...dbde, mined at 22:56:21 UTC in block 84938872.

Each call followed the pattern Defimon describes. The attack contract borrowed CES, used trades against the Algebra pool to move the price the staking contract relied on, and deposited CES through a set of helper contracts while the valuation was off, so the staking contract credited the deposits at more than they were worth. It then repaid what it borrowed and kept the CES the staking contract released. Repeating the call more than a hundred times let the attacker keep drawing on the same flaw until the minute was over.

At 22:56:55 UTC, the attacker withdrew 3,419,998.43 CES from the attack contract to 0x4888...CDA9, the address Defimon identifies as the attacker. A second withdrawal at 23:25:33 UTC moved another 60,230.92 CES to the same address. Blockscout's token transfer history for 0x4888...CDA9 then shows CES leaving the wallet and DAI, USDC and USDT0 coming back.

A Quiet Aftermath

Defimon's alert, posted the same day, reported the loss at $824K and noted that Whalebit's official X account was suspended and that the project's other social channels hadn't mentioned the incident. The loss figure in this post is Defimon's, the only public estimate we found, and Defimon's alert doesn't report any response from the team.

CES has traded below its pre-exploit level since. CoinGecko's hourly prices sit between about $0.73 and $0.86 through April 1 and close to $0.78 through April 2, against the roughly $0.99 to $1.12 range it held on March 30 and 31.

How Olympix Finds a Price the Caller Can Set

Olympix reads a contract the way an attacker does, as states, transitions and entry points, and it works on the code a team ships, so an implementation that was never verified on an explorer gets the same treatment as an open one. In the Whalebit staking contract, the state that matters is how much CES the contract owes each staker and how much it holds. The engine maps every path that can change either one, and the deposit and withdrawal paths are where those two numbers meet a price.

Signals tell the engine which of those paths to attack first, and Olympix's static analysis surfaces the one in this case: a deposit valuation that reads a pool's current reserves or spot price directly, with no time-weighting, no reference price and no deviation check between that read and the credit it produces. Olympix has flagged this class before in other codebases. The signal narrows the search from every path in the contract, to the feasible ones, to the few where a value the caller can move feeds straight into what the contract pays out.

The invariant is plain: a staker shouldn't be able to take out more value than they put in, whatever they do to the pool's price in the same transaction. BugPoCer runs Counterexample-Guided Invariant Refutation from the staking system outward, infers that rule, and executes the flagged path with the pool's price left free to move until the rule breaks. The counterexample it returns is a sequence where a caller trades against the pool, deposits while the valuation is distorted, and leaves with more CES than they brought, along with the minimal conditions that make it work and a generated Forge test that replays it. That's the March 31 attack produced in development instead of on Polygon.

Because Olympix runs in development, at every merge and before release, the finding would have appeared at the merge that wired the Algebra pool's price into the staking contract's valuation, before any CES was ever staked against it.

The Price You Read Is the Price You Pay

Whalebit's staking contract paid out according to a number the depositor could set, and the attacker set it more than a hundred times in under a minute. Every protocol that values deposits, collateral or rewards from a liquidity pool needs that valuation tested against a caller who moves the pool first. To see Olympix map the price reads in your contracts and return a runnable counterexample for any one an attacker can move, book a technical walkthrough.