What happened
On May 19, 2026, an attacker exploited ElevateFi's Polygon staking vault after manipulating the DAI/EFI spot price. The reproduced on-chain transaction shows approximately 6,264.86 EFI paid from the vault, valued near $16,000.
Technical root cause
ElevateFi priced fixed-USD staking packages from raw DAI/EFI AMM reserves via getReserves(), without a time-weighted price, deviation bound, or independent oracle. The reward accounting remained denominated in the package's fixed USD value.
How it happened
- The attacker used temporary DAI liquidity to raise the DAI/EFI spot price, opened 100 fixed-USD staking packages while EFI was artificially expensive, then unwound the price.
- After one reward epoch, the fixed-USD rewards were settled at the lower normalized EFI price, drawing EFI from the staking vault.
Protocol details
Classification
Oracle Manipulation
Protocol Type
DeFi Protocol
Implementation language
Solidity
Attacker Address
0x7abD3f84E28f49f8F3d64Fa21981fA36E4Fb37f0
Exploit Transaction
0x2bd7213a764dd93d18…ec9efed87e
Evidence
- transaction ElevateFi exploit transaction polygonscan.com
- analysis DeFiLlama defillama.com
- analysis DeFiHackLabs ElevateFi exploit PoC raw.githubusercontent.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
