Incident Overview
On March 2, 2026, Curve Lend's LlamaLend suffered a $240K exploit when an attacker manipulated the sDOLA oracle price through a donation attack, forcing liquidations of users who had supplied sDOLA as collateral and borrowed crvUSD. The attacker exploited an incompatibility between Curve Lend's soft-liquidation mechanism and atomically-changeable oracles, causing users to realize instant impermanent losses even though their collateral value increased.
The attacker exploited a fundamental design flaw where Curve Lend's soft-liquidation AMM mechanism cannot handle atomic oracle price changes. First, the attacker triggered soft-liquidations on all users with sDOLA collateral and crvUSD debt, forcing them to "sell" their collateral into crvUSD through the AMM. The attacker then donated assets to the sDOLA pool, manipulating the oracle price from approximately 1.188 sDOLA = 1 DOLA to 1.358 sDOLA = 1 DOLA—a ~14% increase.
Despite collateral values rising, the atomic price change caused instant impermanent loss realization in the soft-liquidation AMM. The attacker then hard-liquidated all soft-liquidated positions, repaying users' crvUSD debt with their crvUSD collateral and keeping the remainder plus the sDOLA. Finally, the attacker deposited the gained sDOLA collateral back into Curve Lend, borrowed crvUSD to repay flash loans, and returned funds to Tornado Cash.
As a side effect, sDOLA holders not using LlamaLend saw a ~14% gain, while DOLA traded at a 1% discount.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Curve Lend, these are the critical security checks that could have prevented this incident (March 2026).
- Verify all logic paths related to Oracle Issue are guarded by proper access controls and input validation - see the Oracle Manipulation & Price Manipulation attack class for patterns
- Audit oracle price feeds for manipulation risks - ensure time-weighted average prices (TWAPs) or multi-source aggregators are used, not spot prices
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Curve Lend
The Curve Lend hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.