Briefing
The core security incident is a multi-chain exploit targeting the V2 Composable Stable Pools of a major Automated Market Maker (AMM). The primary consequence is the immediate and systemic compromise of liquidity across several networks, demonstrating how a single logic flaw can cascade through composable DeFi architecture. The attack vector exploited a faulty internal validation check within the shared vault, resulting in the unauthorized draining of approximately $128 million in liquid staking derivatives and wrapped assets.
Context
The protocol had previously faced smaller incidents related to precision vulnerabilities, underscoring a known class of risk in its complex V2 architecture. The composable design, while capital-efficient, inherently expanded the attack surface by centralizing assets in a single vault that relies on flawless internal validation across multiple pool types. This complexity was a pre-existing, unmitigated systemic risk that has now been fully exploited.
Analysis
The attacker compromised the smart contract logic within the V2 vault’s internal validation mechanism, specifically bypassing the _validateUserBalanceOp check within the manageUserBalance function. This bypass was achieved by deploying a malicious contract that manipulated the pool initialization process and specified unauthorized parameters during batch swap operations. The exploit leveraged a combination of the faulty validation and precision rounding errors inherent in complex pool math to artificially distort internal price information and extract high-value tokens like WETH and wstETH before the system could self-correct. The attack began on the Ethereum mainnet and quickly expanded across other networks where the vulnerable pools were deployed.
Parameters
- Total Funds Drained → $128 Million → The estimated maximum value of digital assets siphoned from the vulnerable V2 pools.
- Vulnerability Type → Internal Validation Bypass → The specific smart contract logic flaw that allowed unauthorized fund manipulation.
- Affected Asset Class → Liquid Staking Derivatives → The primary assets targeted, including wstETH, osETH, and frxETH.
- Affected Networks → Ethereum, Base, Polygon, Arbitrum → The blockchains where the vulnerable pools were deployed and drained.
Outlook
Immediate mitigation for users involves withdrawing all assets from any V2 Composable Stable Pools that remain unpaused or unmigrated, treating them as critically compromised. The second-order effect is a heightened contagion risk for all protocols utilizing similar shared-vault or composable AMM designs, demanding an immediate review of all internal validation and access control logic. This incident will likely establish a new security best practice requiring formal verification of all inter-contract logic, particularly within core vault functions, to prevent state manipulation via unauthorized external calls.
Verdict
This $128 million exploit confirms that the systemic risk of composable DeFi is directly proportional to the weakest link in its centralized vault’s internal validation logic.
