shield Arbitrary Call · $1.5M loss

How Rubic lost $1.5M to an arbitrary call in December 2022

On December 2022, – Rubic was exploited in a arbitrary call, resulting in approximately $1.5M in losses. That makes the – Rubic exploit the 76th largest DeFi incident out of 690 documented in our archive.

Attack Mechanics: How the – Rubic Arbitrary Call Played Out

Exploit Class Applied to – Rubic

The – Rubic incident on December 25, 2022 is classified as a Arbitrary Call. The contract executes an external call with attacker-controlled target or calldata, letting them impersonate the contract. In the full archive, – Rubic is 1 of 21 documented arbitrary call incidents.

– Rubic in Context

At $1.5M, the – Rubic exploit is a significant ($1M–$10M) event compared to the largest same-class incident in our archive — Seneca (2024) at $6M.

Prior Arbitrary Call Before – Rubic

The nearest arbitrary call incident before – Rubic was BrahTOPG, 46 days earlier on November 9, 2022 ($89K lost). The same exploit class surfaced again within the arbitrary call attack surface.

– Rubic Vulnerability Signature

The primary source categorises the – Rubic exploit specifically as “Arbitrary External Call Vulnerability”. This narrower label is entity-specific: it reflects how the – Rubic contract failed, rather than the broad arbitrary call pattern alone.

Impact & Recovery for – Rubic

– Rubic Loss Figure

The – Rubic exploit caused $1,500,000 in losses — a significant ($1M–$10M) incident and the 7th largest of 129 documented in 2022. This single incident represents 0.7% of all tracked losses that year.

Where – Rubic Sits Among Arbitrary Call Attacks

Ranked by loss size, – Rubic is the 2nd largest of 21 arbitrary call incidents documented. That puts the – Rubic loss above the class average of $783.5K.

Timeline Since the – Rubic Incident

The – Rubic exploit occurred 3.3 years ago (1,206 days). The contract, its fork-block, and the attack transaction remain on-chain and forensically reproducible.

Primary Reference for – Rubic

Public post-mortem / on-chain analysis for the – Rubic incident: view source.

FAQ

How much did – Rubic lose?

The – Rubic exploit in December 2022 resulted in $1,500,000 in losses — the 7th largest of 129 DeFi incidents that year.

When did the – Rubic hack happen?

The – Rubic exploit was recorded on December 25, 2022 — 1,206 days ago.

What type of exploit hit – Rubic?

The – Rubic incident is classified as a Arbitrary Call. The contract executes an external call with attacker-controlled target or calldata, letting them impersonate the contract.

How common is the Arbitrary Call pattern seen at – Rubic?

Our archive contains 21 documented arbitrary call incidents. The – Rubic incident is one of them.

How does – Rubic compare to the largest Arbitrary Call attack?

The largest arbitrary call incident in our archive is Seneca (2024) at $6M. The – Rubic loss is $1.5M.

What solution does EIP-1559 propose for Ethereum's transaction fee market?

EIP-1559 introduces a mechanism to make transaction fees more predictable by automatically adjusting a base fee according to network congestion.

What theory does the study support?

The value enhancing theory.