Resupply subDAO Loses $9.5M in Exploit - Unchained

Resupply, a decentralized stablecoin protocol operating as a subDAO of both Convex Finance and Yearn Finance, lost an estimated $9.5 million in a Wednesday exploit, according to a number of blockchain security firms.

The BlockSec team first flagged the exploit through its Phalcon platform’s X account, after which several researchers determined the root cause was the ResupplyPair contract using an empty ERC-4626 wrapper as the price oracle


This story is an excerpt from the Unchained Daily newsletter.

Subscribe here to get these updates in your email for free


ERC-4626 is a tokenized vault standard for Ethereum, which provides a standardized interface for yield-bearing vaults. When an empty ERC-4626 vault is used as a price oracle, it reports inaccurate prices.

As a result, the attacker was likely able to manipulate the exchange rate to zero and enable uncollateralized borrowing of massive amounts of tokens

According to one engineer’s analysis of the attack transaction, the attacker used only 2 crvUSD to borrow 10 million reUSD.

The content is for reference only, not a solicitation or offer. No investment, tax, or legal advice provided. See Disclaimer for more risks disclosure.
  • Reward
  • Comment
  • Share
Comment
0/400
No comments
Trade Crypto Anywhere Anytime
qrCode
Scan to download Gate app
Community
English
  • 简体中文
  • English
  • Tiếng Việt
  • 繁體中文
  • Español
  • Русский
  • Français (Afrique)
  • Português (Portugal)
  • Bahasa Indonesia
  • 日本語
  • بالعربية
  • Українська
  • Português (Brasil)