# MIMSpell3 Cauldron: insolvency check bypass drains 1.7M

MIMSpell3 Cauldron insolvency check bypassed, letting attacker borrow MIM against no collateral across six cauldrons and drain 1.7M USD.

- Payout: Real-world hack
- Severity: high
- Program: MIMSpell3
- Credited: DeFiHackLabs
- Disclosed: 2025-10-04
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-10/MIMSpell3_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20251004-mimspell3
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:liquidation

**Target:** Abracadabra MIM Cauldron (BentoBox cook/repay)
**Root cause:** The Cauldron's cook() with a REPAY action did not properly validate solvency, allowing MIM to be borrowed without adequate collateral.
**Steps:**
1. Fork mainnet at block 23504544.
2. For each of six cauldrons, read BentoBox MIM balance and borrowLimit; if borrowLimit >= balance, call `cook([ACTION_REPAY, ACTION_NO_OP], [0,0], [abi.encode(debtAmount, attacker), ''])` to borrow MIM.
3. Withdraw all borrowed MIM from BentoBox via `withdraw(MIM, self, self, 0, share)`.
4. Swap MIM to 3Crv via Curve router `exchange` through MIM-3CRV pool.
5. Redeem 3Crv for USDT via `remove_liquidity_one_coin(amount, 2, 0)`.
6. Swap USDT to WETH via Uniswap V3 `exactInput` (0.05% pool).
**Exploitation:** Attacker deployed a contract that iterated over six Cauldrons, invoking cook() with a REPAY action to borrow MIM up to each cauldron's borrowLimit without posting collateral, then withdrew MIM from BentoBox, swapped through Curve MIM-3CRV and 3Pool to USDT, and finally to WETH, netting ~1.7M USD.
**Escalation:** Looped across six cauldrons to maximize borrowed MIM before swapping out.
**Insight:** Abracadabra-style Cauldrons using BentoBox cook() with REPAY/NO_OP actions can skip solvency enforcement; check whether borrowLimit vs BentoBox balance gating lets you borrow the full pool balance without collateral.