Harvest Finance Hack
What happened
Harvest Finance's USDC and USDT vaults lost about $33.8 million on October 26, 2020 when an attacker used flash-loaned stablecoins to move the Curve Y pool conditions used in Harvest's vault accounting. The attacker deposited while the manipulated valuation yielded excess fUSDC or fUSDT shares, reversed the Curve trade, and redeemed those shares at the restored valuation. The incident affected the USDC and USDT vaults, not Harvest's DAI, TUSD, WBTC, or renBTC vaults.
Harvest withdrew funds from the affected shared-pool strategies and later made funds returned by the attacker available to affected users alongside GRAIN claims.
Harvest's vault accounting used a real-time valuation derived from a Curve shared pool when minting and redeeming vault shares. That external pool state could be moved by a large same-transaction trade. The attacker exploited the resulting mismatch: shares were minted while the Curve-derived value was manipulated, then redeemed after the trade was reversed. The existing 3% arbitrage threshold allowed the approximately 1% USDC share-price movement used in the documented cycle.
How it happened
- The attacker borrowed large USDC and USDT balances within the attack flow, then made a large Curve Y pool swap that temporarily changed the value Harvest used for an individual stablecoin position.
- With that value distorted, the attacker deposited into a Harvest vault and received more vault shares than the deposit should have produced at an unmanipulated valuation.
- The attacker then reversed the Curve swap and withdrew the Harvest shares at the restored valuation.
- The pattern was repeated across USDC and USDT vault transactions over roughly seven minutes.
Protocol details
Security review history
- HAECHI Audit View report
- PeckShield View report
Funds Recovery
Recovered
$2.5M
Net Loss
$31,319,080
Evidence
Proof of concept
1 availableSources
- report Harvest Finance incident analysis rekt.news
- report Post-mortem medium.com
- report Harvest Flashloan Economic Attack Post-Mortem medium.com
- transaction Harvest initiating exploit transaction etherscan.io
- analysis DeFiLlama defillama.com
- analysis Harvest GRAIN and recovery documentation docs.harvest.finance
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
