What happened
On March 2, 2026, an attacker exploited Curve LlamaLend's sDOLA/crvUSD market on Ethereum. The transaction forced 27 positions into soft liquidation and then inflated the sDOLA vault’s share price, making the positions immediately eligible for hard liquidation. The attacker’s realized profit was reported at roughly $240,000, while the LlamaRisk post-mortem estimated borrower losses at approximately 822,475 crvUSD; those figures describe different outcomes and are not interchangeable.
The market accepted a vault-share collateral price that could be increased permissionlessly within the same transaction, and its liquidation flow could be combined with a large LLAMMA exchange to move borrowers into a vulnerable state. Collateral integrations need manipulation-resistant valuation, limits on same-block rate changes, and liquidation assumptions tested against atomic capital and vault donations.
Case & protocol details
Attack Timeline
The attacker flash-borrowed about $46 million of capital, acquired crvUSD through several routes, and exchanged 13.25 million crvUSD through the LLAMMA AMM, pushing every active sDOLA/crvUSD position into soft liquidation. They then redeemed sDOLA and used the permissionless DolaSavings staking path to donate DOLA into the vault. That raised the vault’s assets-per-share rate inside the transaction, so the collateral valuation used by the lending market jumped while the borrowers were already soft-liquidated.
The attacker hard-liquidated 27 positions, used seized collateral to open a leveraged position, settled the flash financing, and left a profit estimated near $240,000. Curve’s subsequent compensation discussion identifies the borrower-side loss separately from the attacker’s proceeds.
Evidence & learning
Sources and on-chain records
- report Report x.com
- report Report x.com
- report Report x.com
- report LlamaRisk sDOLA-long2 post-mortem gov.curve.finance
- transaction Transaction etherscan.io
- analysis Curve DAO borrower recompense proposal gov.curve.finance
- analysis BlockSec weekly security incident roundup blocksec.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.