Briefing
In June 2025, the Resupply decentralized finance (DeFi) lending protocol suffered a critical exploit, resulting in a loss of approximately $9.6 million in digital assets. The attack leveraged a sophisticated price manipulation technique against a newly deployed, low-liquidity crcrvUSD vault, leading to a zero exchange rate within the ResupplyPair contract. This fundamental flaw allowed the attacker to mint substantial reUSD loans with negligible collateral, directly impacting the protocol’s wstUSR market. Resupply has since fully repaid $10 million in bad debt, demonstrating a commitment to recovery and reinforcing the importance of robust risk management frameworks.
Context
Prior to this incident, the DeFi ecosystem has consistently faced vulnerabilities stemming from complex smart contract interactions, particularly concerning price oracles and nascent liquidity pools. Protocols often deploy new vaults with insufficient initial liquidity, creating an inherent attack surface where minor manipulations can disproportionately affect asset valuations. This incident underscores a persistent risk class where unaudited or poorly initialized contract logic can be exploited for significant financial gain, highlighting the critical need for comprehensive security assessments beyond basic contract audits.
Analysis
The incident’s technical mechanics centered on a price manipulation bug within Resupply’s ResupplyPair smart contract. The attacker initiated the exploit by funding their wallet via Tornado Cash, then made a small donation to a newly deployed crcrvUSD vault. This seemingly innocuous transaction artificially inflated the perceived value of the crcrvUSD token within the low-liquidity vault. Crucially, the protocol’s exchange rate calculation, which used integer division, rounded down to zero when the inflated price exceeded a specific threshold.
This zero exchange rate effectively bypassed the platform’s insolvency checks, enabling the attacker to borrow approximately $9.6 million in reUSD stablecoins using only 1 wei of crcrvUSD as collateral. The stolen funds were subsequently swapped to stablecoins and Ethereum on decentralized exchanges like Curve and Uniswap, then distributed across two separate Ethereum addresses.
Parameters
- Protocol Targeted → Resupply (DeFi lending protocol)
- Attack Vector → Price Manipulation / Integer Division Vulnerability
- Financial Impact → $9.6 Million (initial loss), $10 Million (bad debt repaid)
- Affected Component → ResupplyPair smart contract, wstUSR market, crcrvUSD vault
- Blockchain → Ethereum
- Attacker Funding → Tornado Cash
- Recovery Status → Full repayment of bad debt by August 2025
Outlook
In the immediate aftermath, Resupply paused affected contracts to prevent further losses, demonstrating swift incident response. The successful repayment of the $10 million bad debt, utilizing treasury funds and an insurance pool, sets a precedent for robust recovery mechanisms in DeFi, potentially influencing future regulatory expectations regarding financial crisis management. This incident reinforces the critical need for protocols to implement rigorous input validation, comprehensive oracle checks, and thorough edge-case testing, especially for newly deployed contracts or those interacting with low-liquidity assets. Developers must prioritize secure-by-design principles, ensuring that all contract logic, particularly division operations, accounts for potential price manipulations to prevent similar vulnerabilities.
Verdict
The Resupply exploit serves as a stark reminder that fundamental smart contract design flaws, particularly in exchange rate calculations and oracle dependencies, remain a primary attack vector, demanding continuous, rigorous auditing and proactive liquidity management for all DeFi protocols.
Signal Acquired from → halborn.com
