Seneca Protocol's Chamber contract was exploited on February 28, 2024 via improper token approval handling that allowed unauthorized transfers of ~1,900 ETH and 50,000 senUSD. The attacker later returned 80% of funds after being offered a 20% bounty.

On February 28th, a vulnerability was discovered in the contract of Seneca, an omnichain CDP protocol on the Ethereum network. Hackers exploited constructed calldata parameters to call transferfrom, transferring tokens authorized to the project contract to their address, ultimately exchanging them for ETH. Seneca was exploited by hackers for over 1900 ETH, valued at approximately $6.5 million. On February 29th, the hacker address of SenecaUSD returned 1537 ETH (approximately $5.3 million) to the deployer address of Seneca.