What happened
DRLVaultV3, a vault that rebalanced between USDC and WETH on Ethereum, lost about $100,000 in USDC on November 10, 2025. Its swapToWETH function set its minimum-output (slippage) limit from the Uniswap V3 pool's current quote in the same transaction. Anyone who moved the pool price first could therefore make the vault buy WETH at a terrible rate without tripping the check.
The transaction came from c0ffeebabe.eth, an address known for whitehat front-running, and Nominis reports that about $97,600 was later returned.
How it happened
- The attacker flash-borrowed about 13.98 million USDC from Morpho Blue.
- It swapped the USDC for about 813 ETH in the USDC/WETH Uniswap V3 pool, pushing the WETH price sharply up.
- It called
swapToWETHon the vault, which swapped 100,000 USDC of its own funds into WETH at the inflated price. The vault's minimum-output check used the same manipulated quote, so it passed. - The attacker sold its WETH back into the pool, which returned the price toward normal and captured the value the vault had overpaid. It then repaid the flash loan.
Protocol details
Classification
Oracle Manipulation
Protocol Type
DeFi Protocol
Implementation language
Solidity
Evidence
- report Monthly Report: Crypto Attacks in November 2025 (Nominis) nominis.io
- transaction Etherscan attack transaction 0xe3eab35b...c475 etherscan.io
- analysis DeFiLlama defillama.com
- analysis The DRLVaultV3 Exploit: A Slippage Design Failure (Verichains) blog.verichains.io
- analysis DeFiHackLabs DRLVaultV3_exp.sol raw.githubusercontent.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
