Abracadabra.money: An Overview

Abracadabra.money operates as a decentralized lending system that accepts interest-bearing tokens (ibTKNs) as collateral to unlock liquidity in Magic Internet Money (MIM), a USD-pegged omnistablecoin. Users can borrow MIM against their yield-generating crypto holdings instead of selling them.

Overview

Abracadabra.money spans multiple chains, including Ethereum, Arbitrum, and Fantom, and had a Total Value Locked (TVL) of about $154 million as of early October 2025.

The protocol has endured several notable security incidents resulting in cumulative losses exceeding $20 million since 2024. In response, the protocol’s decentralized autonomous organization (DAO) has acted to limit damage, such as using treasury reserves to repurchase stolen assets and stabilize the MIM stablecoin.

Technology and Architecture

Kashi Lending Technology and Isolated Markets

Abracadabra.money employs Kashi Lending Technology, a framework pioneered by SushiSwap, to create its lending markets. The defining feature is the use of isolated markets called Cauldrons, which confine the risk of each collateral type to its own market, preventing a single asset's volatility from jeopardizing the entire protocol.

• Cauldrons: Isolated lending vaults where users deposit a specific collateral to borrow or mint MIM, each with its own risk parameters. Multiple Cauldron versions exist, including V3 and V4, which have experienced security exploits.
• BentoBox (and Degenbox): BentoBox serves as the token vault underpinning Abracadabra's Cauldrons, acting as the central repository for user collateral. Abracadabra utilizes a particular implementation called Degenbox, designed to generate yield on held assets while they back loans.
• The `cook()` Function: A potent Cauldron feature enabling users to batch actions such as adding collateral, borrowing MIM, and repaying debt into a single atomic transaction. While aimed at efficiency, a logical flaw in this function was responsible for a major exploit in October 2025.

Tokenomics

Abracadabra.money centers on three main tokens: SPELL, sSPELL, and MIM. SPELL serves as the ecosystem’s incentive token, while sSPELL is the staked variant that grants governance rights and a share of platform revenue; MIM is the decentralized, USD-pegged stablecoin minted against deposited collateral.

• SPELL: The native utility and rewards token, primarily used to incentivize liquidity.
• sSPELL: A staked form of SPELL that confers governance voting rights and a portion of the protocol's revenue.
• MIM (Magic Internet Money): The protocol's decentralized USD-pegged stablecoin minted against deposited collateral.
• Token Symbol: SPELL
• Total Supply: 210,000,000,000 SPELL (the original 420B supply was halved via a one-time burn)
• 45% (94.5B SPELL): MIM-3LP3CRV Liquidity Incentive
• 30% (63.0B SPELL): Team allocation (4 Year Vesting Schedule)
• 18% (37.8B SPELL): ETH-SPELL SushiSwap Liquidity Incentive
• 7% (14.7B SPELL): Initial DEX Offering

Governance

Governance is conducted by a decentralized autonomous organization composed of sSPELL holders, which determines key parameters, risk controls, and treasury allocations.

In October 2025, following a security incident, the DAO deployed treasury funds to buy back stolen MIM on the open market to stabilize the price and repair bad debt, with a contributor named 0xMerlin publicly outlining the response to the community.

Security Incidents

Since 2024, the protocol has faced several major breaches, totaling losses of more than $21 million and prompting scrutiny of security practices.

October 2025: cook() Function Exploit (~$1.8M Loss) — A logic flaw in a deprecated CauldronV4 contract allowed the attacker to borrow MIM without adequate collateral after bypassing a solvency check, resulting in roughly $1.79 million stolen and laundered through Tornado Cash; the affected market was paused and the treasury used to repurchase MIM.

March 2025: GMX Cauldron Exploit (~$13M Loss) — An attacker drained 13 million MIM from GMX-linked liquidity pools on Arbitrum via a complex flash loan attack targeting the collateral accounting of GmxV2 CauldronV4; the attacker laundered the funds (about 6,260 ETH) through Ethereum and Tornado Cash.

• June 2024 Exploit ($6.5M Loss): A precision-loss vulnerability in Cauldron V3 and V4 caused a desynchronization between internal debt-tracking variables (elastic and base), enabling the attacker to accumulate a large debt and borrow more MIM than allowed, contributing to MIM depegging.
• January 2024 Exploit ($6.4M Loss): An Ethereum-based attack, reportedly initiated with 1 ETH, exploited a rounding or precision flaw to bypass insolvency checks, creating bad debt and a temporary MIM de-peg.