Impermax V3 Hack

On November 11, 2025, Impermax V3 suffered an exploit that drained approximately 5.39 cbBTC (~$380,000 or ~110 ETH) from its cbBTC lending vault on Base. The attacker exploited a rounding error vulnerability in the liquidation mechanism combined with exchange rate manipulation to drain funds from the vault through the flashAllocate function.

The sophisticated multi-step attack exploited two key vulnerabilities: a rounding error in the liquidation mechanism and an unprotected allocation function in curator contracts. The attacker targeted the cbBTC-tBTC pair borrowable with near-zero totalBalance (~1000 wei). The attack process involved: (1) Creating positions with minimal collateral (3 wei cbBTC) to borrow 1 wei cbBTC and maximum tBTC; (2) Liquidating positions after oracle updates to trigger underwater states; (3) Calling restructureBadDebt() repeatedly to reduce totalBalance from ~1000 wei to 1 wei, progressively lowering the exchangeRate; (4) Minting 1 wei of cbBTC and repeating liquidations to exponentially decrease exchangeRate while exponentially increasing personal borrowable token balance; (5) Reducing totalBalance to exactly 0, causing exchangeRate() to default to 1e18; (6) Exploiting the malicious state where any new deposits would benefit the attacker instead of depositors; (7) Calling flashAllocate() to force the lending vault to deposit into the compromised borrowable; (8) Withdrawing vault funds due to the manipulated exchange rate.

Hypernative detected the attack within minutes, and the team disabled borrowable connections to lending vaults as mitigation.