Minterest Hack
What happened
Minterest's Mantle market lost about $1.4 million after an unaudited mUSDY extension allowed flash-loan-assisted reentrancy and exchange-rate manipulation. The incident occurred July 14, 2024; the July 15 record date reflects public reporting. Ethereum and Taiko deployments were unaffected.
A Mantle-specific, unaudited mUSDY market extension allowed reentrancy during a distorted exchange-rate state. The reentrant lending path minted more mTokens than intended, while later withdrawals applied the normal rate.
How it happened
A flash loan lowered market cash and altered the exchange rate. The attacker's fallback converted borrowed USDY to mUSD and re-entered through lendRUSDY while the distorted rate was used, minting excess mTokens. Withdrawals then used the correct rate, leaving excess mUSDY tokens.
Repeating the cycle built excess mTokens and enabled borrowing and draining WETH and mETH. Minterest paused Mantle operations, patched the mUSDY and exchange-rate paths, and offered a recovery bounty, but no attacker-fund recovery is confirmed.
Protocol details
Security review history
- Trail of Bits View report
- Hacken View report
- PeckShield View report
- Zokyo View report
Evidence
Proof of concept
1 available- Code Minterest Reentrancy
Sources
- report @Minterest incident report x.com
- report @De_FiSecurity incident report x.com
- report Minterest Security Incident Post-Mortem minterest.com
- transaction Minterest Exploit Transaction explorer.mantle.xyz
- analysis DeFiLlama defillama.com
- analysis Minterest Hack Analysis halborn.com
- analysis Minterest CEO Letter minterest.com
- analysis Minterest Reopening Update minterest.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
