How Does WOOFi Work?
A multi-chain decentralized exchange that uses a custom pricing algorithm fed by centralized market makers instead of traditional liquidity pools. It manages $30M in deposits. Its D+ grade reflects a $8.75M hack in March 2024 where an attacker used flash loans to manipulate the pricing engine, and the same attack could be repeated on other chains.
TVL
$4M
Sector
DEX
Risk Grade
C
Value Grade
D+
Core Mechanisms
AMM/Custom-Bonding-Curve
NovelsPMM (Synthetic Proactive Market Making): simulates CEX order book dynamics on-chain using market maker price feeds
sPMM uses WOO Network market maker data to simulate centralized exchange order book depth, spread, and mid-price on-chain. Price is determined by oracle feeds and algorithm rather than pool liquidity. This is fundamentally different from standard AMM designs.
Oracle/Custom-Network
NovelWOO Network proprietary on-chain oracle with 0.1% deviation update threshold, spread, and liquidity coefficient parameters
Custom oracle feeds contain mid-price, spread, and liquidity coefficient data updated at 0.1% price deviation. More granular than standard Chainlink feeds but dependent on WOO Network infrastructure. The oracle's interaction with low-liquidity conditions was the root cause of the March 2024 exploit.
Oracle/Chainlink-Fallback
Chainlink oracle as fallback and sanity check against sPMM primary pricing
Chainlink feeds serve as a secondary check against sPMM pricing. The fallback was insufficient to prevent the March 2024 exploit because the sPMM price manipulation stayed within acceptable deviation bounds during the attack.
DEX/Multi-Chain
Multi-chain DEX deployment across Arbitrum, BSC, Polygon, Avalanche, and other EVM chains
WOOFi operates identical sPMM pools across multiple chains. Each chain deployment has independent liquidity and may have different WOO token liquidity depth, creating varying vulnerability profiles.
Staking/Revenue-Sharing
WOO token staking for fee discounts and governance (29% of market cap staked)
WOO staking provides trading fee discounts and governance voting power. 29% of market cap is staked ($17.2M), aligning token holders with protocol success but creating concentrated sell risk if stakers unstake.
Derivatives/Perpetual
WOOFi Pro perpetual futures trading with shared on-chain liquidity
Perpetual futures markets share liquidity with spot sPMM pools. Cross-product liquidity sharing creates additional attack vectors where perp positions can influence spot pricing.
Security/Circuit-Breaker
Price deviation circuit breakers and guardian pause mechanism added post-exploit
Post-March 2024 exploit, WOOFi implemented tighter price deviation checks and guardian-controlled pause mechanisms. Effectiveness depends on detection speed vs. exploit execution speed.
How the Pieces Interact
Flash loans enable manipulation of WOO token price to exploit sPMM pricing in a single transaction. The March 2024 $8.75M exploit on Arbitrum demonstrated this exact attack vector: borrow WOO, dump to crash sPMM price, buy back at manipulated price, repay loan and profit.
On chains where WOO token has thin liquidity (e.g., Arbitrum), the sPMM price impact function can be overwhelmed by large trades, allowing the price to be pushed to near-zero. The algorithm was designed for adequate liquidity conditions that did not exist on all deployment chains.
sPMM pricing depends entirely on WOO Network's off-chain market maker infrastructure. If the market maker goes offline, prices become stale. Any latency between market maker updates and on-chain state creates an arbitrage window that extracts value from LPs.
The Chainlink fallback oracle updates less frequently than the custom WOO oracle. During rapid price movements, the gap between the two creates a window where the sPMM quotes are exploitable but the fallback check does not trigger.
WOOFi operates on 5+ chains with independent liquidity. An exploit on one chain may not trigger alerts on others fast enough, allowing sequential exploitation across chains before global pause is activated.
What Could Go Wrong
- sPMM pricing algorithm was exploited for $8.75M in March 2024 via flash loan manipulation of WOO token price on Arbitrum
- Entire pricing model depends on WOO Network centralized market makers for oracle feeds; market maker failure causes stale or manipulable prices
- Multi-chain deployment multiplies the attack surface; the March 2024 exploit pattern could be replicated on other chains with low WOO liquidity
sPMM Oracle Manipulation Exploit
ElevatedTrigger: An attacker manipulates WOO token price via flash loans to exploit the sPMM pricing algorithm, repeating the March 2024 attack pattern on a different chain or token pair
- 1.Attacker flash-borrows millions of WOO tokens and dumps them on WOOFi to crash the sPMM internal price — sPMM algorithm quotes an artificially depressed price for WOO, far below fair market value
- 2.Attacker buys WOO at the manipulated price using stablecoins at near-zero cost — Attacker extracts millions in value from the liquidity pool in a single transaction
- 3.Attack is repeated across multiple token pairs or chains before detection — Multiple liquidity pools drained; total losses compound with each iteration
- 4.WOOFi pauses trading across all chains as exploit is detected — All LP capital is frozen; users cannot withdraw or trade during investigation
Risk Profile at a Glance
Overall: C (50/100)
Lower score = safer