BlueBerry Hack

Reported loss $1.4M
Ethereum
Flash-loan-assisted borrowing against incorrectly scaled asset values

What happened

Blueberry's Ethereum lending market was exploited after a faulty oracle deployment valued low-decimal assets incorrectly and borrowing was enabled earlier than intended. About $1.4 million was affected; a whitehat front-ran and returned roughly 80%, and Blueberry committed its multisig funds to make lenders whole.

Technical root cause

PriceOracleProxy delegated to a CoreOracle that returned prices at 18 decimals. Assets with fewer decimals were incorrectly valued when borrowed, and borrowing had been enabled before the configuration was intended to go live.

How it happened

The attacker used a 1 WETH Balancer flash loan, deposited it into the lending market, and borrowed available liquidity in assets with fewer than 18 decimals, which the misconfigured oracle severely undervalued. The drained assets included OHM, USDC, and WBTC.

A whitehat front-ran and returned about 80% to the DAO multisig. The remaining amount was lost to the validator, while Blueberry stated it had sufficient multisig funds to reimburse lenders.

Protocol details

Classification Oracle decimal-scaling misconfiguration / collateral-valuation error
Protocol Type Yield
Affected asset / contract bWETH
Implementation language Solidity
Protocol links Website @blueberryFDN
Exploit Transaction 0xf0464b01d962f714ee…346b8b06e4

Security review history

Funds Recovery

80.0%

Recovered

$1.1M

Net Loss

$280,000

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Flash Loan Attacks Oracle Manipulation & Price Manipulation

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes