Flurry Finance yield aggregator was exploited via manipulation of the rhoToken multiplier. An attacker switched an address from EOA to contract and artificially inflated rhoToken balance, then redeemed inflated shares to withdraw underlying stablecoins from the FinanceRabbit strategy vault.

Flurry Finance’s Vault contract was hit by a flash loan attack, resulting in the theft of approximately $293,000 worth of assets in the Vault contract.