Incident Overview
On November 11, 2025, Impermax V3 suffered an exploit that drained approximately 5.39 cbBTC (~$380,000 or ~110 ETH) from its cbBTC lending vault on Base. The attacker exploited a rounding error vulnerability in the liquidation mechanism combined with exchange rate manipulation to drain funds from the vault through the flashAllocate function.
The sophisticated multi-step attack exploited two key vulnerabilities: a rounding error in the liquidation mechanism and an unprotected allocation function in curator contracts. The attacker targeted the cbBTC-tBTC pair borrowable with near-zero totalBalance (~1000 wei). The attack process involved: (1) Creating positions with minimal collateral (3 wei cbBTC) to borrow 1 wei cbBTC and maximum tBTC; (2) Liquidating positions after oracle updates to trigger underwater states; (3) Calling restructureBadDebt() repeatedly to reduce totalBalance from ~1000 wei to 1 wei, progressively lowering the exchangeRate; (4) Minting 1 wei of cbBTC and repeating liquidations to exponentially decrease exchangeRate while exponentially increasing personal borrowable token balance; (5) Reducing totalBalance to exactly 0, causing exchangeRate() to default to 1e18; (6) Exploiting the malicious state where any new deposits would benefit the attacker instead of depositors; (7) Calling flashAllocate() to force the lending vault to deposit into the compromised borrowable; (8) Withdrawing vault funds due to the manipulated exchange rate.
Hypernative detected the attack within minutes, and the team disabled borrowable connections to lending vaults as mitigation.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Impermax V3, these are the critical security checks that could have prevented this incident (November 2025).
- Verify all logic paths related to Zero-Rate Hack / Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
- 01
- 02
- 03
Learn to Prevent the Next Impermax V3
The Impermax V3 hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.