permissionless Convex stakeFor inflates Strategy NAV and lets VaultYUSDT overpay on withdrawAll
מה ידוע על המתקפה?
הסיווג ושיטת התקיפה משקפים את דיווחי המקורות. תיאורים מפורטים מוצגים בשפת המקור; לקריאת התחקיר המלא ניתן לפתוח את הקישור המצורף.
DefiLlamaתיאור המקור באנגלית
Flamincome’s VaultYUSDT strategy valued its Convex-staked Curve USDP LP position using the strategy’s BaseRewardPool.balanceOf() multiplied by Curve’s spot get_virtual_price(). The attacker used approximately $18M USDT of Morpho flash liquidity to acquire USDP and imbalance-mint USDP metapool LP, then permissionlessly staked LP for the strategy through Convex. This temporarily increased the strategy’s reported holdings/NAV. VaultYUSDT immediately incorporated the manipulated valuation into its share price, allowing the attacker to redeem shares at an inflated value and force the strategy to withdraw real aUSDT liquidity from Aave
SlowMistתיאור המקור באנגלית
Flamincome (legacy contracts of Flamingo Finance) was exploited due to unsafe asset accounting and valuation. The attacker flash-loaned ~$18M USDT, injected USDP/3CRV LP into the Strategy (treating a permissionlessly injectable Convex BaseRewardPool balance as its own assets and overvaluing it via Curve’s get_virtual_price() in a depegged pool), inflated the VaultYUSDT share price, and redeemed real Aave aUSDT liquidity for ~$345.9K profit.
permissionless Convex stakeFor inflates Strategy NAV and lets VaultYUSDT overpay on withdrawAll
מה ידוע על המתקפה?
הסיווג ושיטת התקיפה משקפים את דיווחי המקורות. תיאורים מפורטים מוצגים בשפת המקור; לקריאת התחקיר המלא ניתן לפתוח את הקישור המצורף.
DefiLlamaתיאור המקור באנגלית
Flamincome’s VaultYUSDT strategy valued its Convex-staked Curve USDP LP position using the strategy’s BaseRewardPool.balanceOf() multiplied by Curve’s spot get_virtual_price(). The attacker used approximately $18M USDT of Morpho flash liquidity to acquire USDP and imbalance-mint USDP metapool LP, then permissionlessly staked LP for the strategy through Convex. This temporarily increased the strategy’s reported holdings/NAV. VaultYUSDT immediately incorporated the manipulated valuation into its share price, allowing the attacker to redeem shares at an inflated value and force the strategy to withdraw real aUSDT liquidity from Aave
SlowMistתיאור המקור באנגלית
Flamincome (legacy contracts of Flamingo Finance) was exploited due to unsafe asset accounting and valuation. The attacker flash-loaned ~$18M USDT, injected USDP/3CRV LP into the Strategy (treating a permissionlessly injectable Convex BaseRewardPool balance as its own assets and overvaluing it via Curve’s get_virtual_price() in a depegged pool), inflated the VaultYUSDT share price, and redeemed real Aave aUSDT liquidity for ~$345.9K profit.
