NumaMoney Hack

On April 18, 2025, NumaMoney, a non-custodial and decentralized LST-backed synthetics protocol on Arbitrum, was exploited for approximately $506,000-$527,000. The attacker used a sophisticated price manipulation scheme involving flash loans from Aave V3, Balancer Vault, and Uniswap V3 pools to manipulate the NUMA token price and enable excessive borrowing and collateral withdrawal.

The root cause was a critical lack of real-time price validation and slippage protection within the NumaVault contract's sell() function, combined with reliance on internal NumaPriceOracleNew data without external validation. The attacker executed a multi-stage attack: first securing 3,760 rETH and 631,422 NUMA via flash loans, then depositing rETH and minting crEth using NumaComptroller. They borrowed 3,626,482 NUMA multiple times via CNumaLst.borrowFreshNoTransfer, which lacked supply caps and relied on manipulable pricing.

The critical manipulation occurred when the attacker called NumaVault.sell() with a massive NUMA amount, skewing the last_lsttokenvalueWei variable from 148,850,422,003,959 to 116,943,924,501,586. They then used lockNumaSupply(true) to freeze this manipulated price, preventing yield-driven rebalancing. The attacker donated 150 rETH to further skew the NUMA price, redeemed 283 rETH via CNumaLst.redeemFresh exploiting the inflated exchange rate, and repurchased 85,511 NUMA at the artificial price.

The stolen funds were moved from Arbitrum to Ethereum using multiple bridges and laundered through Tornado Cash. Notably, the Hypernative platform detected the attack 7 minutes before execution, making the loss entirely preventable.

Exploit TX:

https://arbiscan.io/tx/0x74a19463…e40e3c