Nerve Finance Hack

Reported loss $586K
BNB Chain
Other

What happened

On November 15, 2021, an attacker drained the fUSDT and UST metapools of Nerve Finance's bridge pools on BNB Chain and made about 900 BNB, which Halborn valued at about $537,000.

Nerve's metapools used Saddle Finance's MetaSwap code. Nine days earlier the same bug had been exploited in Synapse's nUSD metapool. In MetaSwap, swap and swapUnderlying value the base-pool LP token differently. swapUnderlying accounts for the Nerve 3pool's virtual price, but swap ignores it. So swap always underprices the 3pool LP token, and a trader receives more LP tokens than they should for their fUSDT.

The attacker used 50,000 BUSD flash loans from ForTube and repeated a five-step loop in around 200 transactions. In one round, 50,000 BUSD became 50,351 fUSDT, then 36,959 Nerve 3pool LP tokens, then 37,071 BUSD, and finally 51,494 fUSDT, about 1,140 more fUSDT than the round started with.

Example attack transaction: 0xea95925eb0438e04d0d81dc270a99ca9fa18b94ca8c6e34272fc9e09266fcf1d

How it happened

  1. The attacker took a 50,000 BUSD flash loan from ForTube and swapped it for 50,351 fUSDT.
  2. It called swap on the fUSDT MetaSwap pool and received 36,959 Nerve 3pool LP tokens. Because swap ignores the 3pool virtual price, this was more LP than the fUSDT was worth.
  3. It called removeLiquidityOneCoin on the Nerve 3pool and redeemed the LP tokens for 37,071 BUSD.
  4. It called swapUnderlying on the metapool to trade the BUSD for 51,494 fUSDT. This path does use the virtual price, so the round ended with more fUSDT than it started with.
  5. It repeated the loop around 200 times across the fUSDT and UST metapools until their liquidity was gone, repaid the loans and kept about 900 BNB.

Protocol details

Classification Exchange (DEX) / Protocol Logic
Protocol Type DEX
Category Bridge Hack
Affected asset / contract NRV
Implementation language Solidity
Protocol links Website @NerveFinance

Evidence

Same attack technique

Browse all hacks →
BNB Chain ATM Token $244K lost Arbitrum TheStandard.io $290K lost BNB Chain Utopia $120K lost Ethereum Swapos $468K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes