Raft Hack

Reported loss $3.3M
Ethereum
Infinite Mint and Dump

What happened

Raft's collateral-share minting contained a rounding flaw that an attacker amplified by donating cbETH. Tiny deposits then received disproportionately valuable shares, enabling excess collateral claims and issuance of R stablecoins. Most of the ETH obtained by selling R was subsequently burned.

Technical root cause

The share calculation used divUp at a very large collateral index. A nonzero deposit could round up to a whole smallest-unit share whose redemption value greatly exceeded the deposit.

How it happened

  1. The attacker flash-borrowed cbETH and donated it to InterestRatePositionManager.
  2. A liquidation of a prepared position amplified the collateral index.
  3. Repeated tiny deposits exploited upward rounding to mint shares worth far more than the deposited collateral.
  4. The attacker redeemed the inflated share position, borrowed R, and sold it through liquidity pools. Most of the resulting ETH was sent to a burn address.

Protocol details

Classification Protocol Logic / Stablecoin / Borrowing and Lending / Token & Share Accounting
Protocol Type CDP
Affected asset / contract RAFT
Implementation language Solidity
Protocol links Website @raft_fi

Security review history

Evidence

Proof of concept

1 available

Sources

Same attack technique

Browse all hacks →
Saga Saga $7.0M lost Ethereum Holograph $14.4M lost Ethereum Paid Network $27.4M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes