Resupply subDAO Loses $9.5M in Exploit - Unchained

Resupply, a decentralized stablecoin protocol operating as a subDAO of both Convex Finance and Yearn Finance, lost an estimated $9.5 million in a Wednesday exploit, according to a number of blockchain security firms.

The BlockSec team first flagged the exploit through its Phalcon platform’s X account, after which several researchers determined the root cause was the ResupplyPair contract using an empty ERC-4626 wrapper as the price oracle

This story is an excerpt from the Unchained Daily newsletter.

Subscribe here to get these updates in your email for free

ERC-4626 is a tokenized vault standard for Ethereum, which provides a standardized interface for yield-bearing vaults. When an empty ERC-4626 vault is used as a price oracle, it reports inaccurate prices.

As a result, the attacker was likely able to manipulate the exchange rate to zero and enable uncollateralized borrowing of massive amounts of tokens

According to one engineer’s analysis of the attack transaction, the attacker used only 2 crvUSD to borrow 10 million reUSD.