What happened
On October 14, 2021, an attacker exploited Indexed Finance's Ethereum index pools, DEFI5 and CC10, using flash liquidity to manipulate the controller's estimate of pool value. By driving down the balance of the token used as the controller's valuation anchor, the attacker reduced the minimum balance required to initialize a new asset, minted index tokens at a distorted rate, and redeemed them for a disproportionate share of the pools' underlying assets. Indexed Finance estimated the combined loss at about $16 million.
updateMinimumBalance estimated the entire index-pool value from the live balance and target weight of one initialized token. An attacker could change that balance atomically with flash swaps while the token weight remained unchanged, causing a false minimum balance and abnormal weight for a newly initialized asset.
Case & protocol details
Attack Timeline
The attacker triggered a DEFI5 reindex that added SUSHI, then flash-borrowed the pool's initialized assets and repeatedly swapped them into UNI. That sharply lowered UNI's on-pool balance while the controller retained its target weight. When the attacker called updateMinimumBalance, the controller used the depleted UNI balance to underestimate the value of the entire pool, reducing SUSHI's initialization threshold.
The attacker supplied SUSHI, called gulp to mark it ready with an abnormal weight, minted an inflated quantity of DEFI5 with single-asset joins, and burned those index tokens through exitPool for the basket of underlying assets. A materially equivalent path drained CC10. Flash liquidity provided atomic scale, but the root cause was manipulable pool valuation used in index-token initialization.
Evidence & learning
Proof of concept
1 availableSources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.