What happened
On March 2, 2026, a flash-loan donation attack on Curve LlamaLend’s sDOLA/crvUSD market hard-liquidated 27 borrowers; the exploiter profit was approximately $240,000.
Technical root cause
The sDOLA collateral oracle used a vault exchange rate that could be materially inflated by a direct DOLA donation after the attacker reduced the vault share supply.
How it happened
The attacker flash-borrowed assets, acquired and redeemed sDOLA to reduce supply, donated DOLA via stake() to inflate the sDOLA exchange rate, then liquidated borrowers made unhealthy by the oracle movement.
Protocol details
Classification
Protocol Logic / Token & Share Accounting
Protocol Type
Lending
Implementation language
Solidity
Protocol links
Website
@CurveFinance
Evidence
Proof of concept
1 available- Code Curve LlamaLend
Sources
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
