On November 10, 2023, an attacker exploited a precision error in Raft's divUp function during share token minting to mint ~$6.7M unbacked R tokens via a 6000 cbETH flash loan from Aave, causing a ~$3.3M net loss.