Briefing
The Resupply stablecoin protocol suffered a critical $9.5 million exploit targeting its newly deployed lending market. The primary consequence is a significant bad debt accrual and a collapse of investor confidence in the protocol’s fundamental solvency. This was achieved through a donation attack that manipulated the price-per-share calculation in an empty ERC-4626 vault, allowing the attacker to borrow approximately $10 million in reUSD using negligible collateral. The total value lost from the wstUSR market is confirmed to be $9.5 million.
Context
The prevailing attack surface in the DeFi lending sector remains logic flaws in asset valuation and oracle-like mechanisms, particularly within new deployments. This incident leveraged the known risk associated with the ERC-4626 standard’s initial state, where an empty vault is susceptible to price-per-share manipulation before equilibrium is established. The exploit occurred shortly after the new market’s DAO governance approval, indicating a critical lapse in pre-deployment security checks.
Analysis
The attack targeted the ResupplyPair smart contract, specifically its reliance on the vault’s balanceOf function for exchange rate calculation. The attacker used a small donation of crvUSD to artificially inflate the price-per-share of the newly deployed, empty cvcrvUSD vault. By minting a minimal amount of shares (1 wei) at this inflated price, the attacker tricked the protocol into valuing this collateral at millions of dollars. This price distortion allowed the threat actor to bypass the protocol’s solvency checks and borrow $10 million in the native stablecoin reUSD , which was immediately swapped for WETH and USDC.
Parameters
- Total Loss Value → $9.5 Million (The total value of assets drained from the protocol)
- Vulnerable Component → ERC-4626 Vault (The newly deployed vault standard used for asset tracking)
- Exploit Method → Donation Attack (Manipulating the initial share price of an empty vault)
- Collateral Used → 1 Wei of Shares (The negligible amount of shares used to borrow $10M)
Outlook
Immediate mitigation requires all protocols utilizing ERC-4626 vaults to implement virtual share mechanisms or offset functions to prevent price-per-share manipulation at deployment. The second-order effect is a renewed focus on “donation attack” vectors, especially in low-liquidity or newly launched markets, increasing contagion risk for similar lending protocols. This incident establishes a new best practice → mandating a non-zero initial deposit or a robust check against zero-balance vaults, even post-audit.
Verdict
The Resupply exploit is a definitive case study demonstrating how a known ERC-4626 initialization flaw can be weaponized to bypass fundamental DeFi lending solvency checks.
