What happened
Two vFarms were exploited:
50% IRON — 50% SIL
50% IRON — 50% BUSD
A user who farmed in these two pools claimed all SIL rewards allocated for farming over the next 12 months and made a profit of around $170K by selling SIL for BUSD on vSwap.
Value DeFi team has upgraded FaaS, in which the reward rate is in normal integer instead of Ggwei as before. Iron.Finance team was unaware of the change and updated Iron vFarm pools with reward rate in Gwei. This caused the pools' rewards to inflated by 10^18 times.
The following address took advantage of the mistake and drained all SIL rewards and sold them to the market:
https://bscscan.com/address/0x69655181…63e9e5#tokentxns
Case & protocol details
Evidence & learning
Sources and on-chain records
- report Report ironfinance.medium.com
- report Report beincrypto.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.