What happened
On January 2, 2024, an attacker exploited Radiant Capital's newly launched native USDC market on Arbitrum, ultimately borrowing 1,900 WETH, reported at about 4.5 million dollars. The attack inflated the new market's liquidity index while its reserves were effectively empty, then used rounding in the rToken burn path to withdraw collateral that should have remained locked. Radiant paused its lending pools and later resumed markets while the native USDC market remained under review.
How it happened
- The attacker targeted the newly initialized native USDC reserve while it had no other user deposits.
- The attacker donated native USDC and repeatedly used flash loans, causing fees to accrue to a single rUSDC position and sharply inflating the liquidity index.
- The inflated index made the attacker's collateral appear more valuable, allowing WETH borrowing.
- Precision loss when burning rUSDC let the attacker withdraw the USDC collateral as well, leaving bad debt after borrowing 1,900 WETH.
Protocol details
Classification
Borrowing and Lending / Protocol Logic / Token & Share Accounting
Protocol Type
Lending
Affected asset / contract
RDNT
Implementation language
Solidity
Protocol links
Website
@RDNTCapital
Security review history
- Solidity Finance View report
Evidence
- report @RDNTCapital incident report twitter.com
- report @peckshield incident report twitter.com
- report Post-Mortem Report: Radiant Capital medium.com
- transaction Arbiscan: Radiant exploit transaction arbiscan.io
- analysis Web Archive archive.ph
- analysis DeFiLlama defillama.com
- analysis MetaTrust: Radiant Protocol flash-loan attack analysis metatrust.io
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
