What happened
On September 5, 2026 an attacker took about 9.25 ETH (roughly $23,000) from Reddio's RedSonic Vault on Ethereum in a single flash-loan transaction. SlowMist traced the root cause to cross-vault double counting. Anyone could register a new ERC-20 vault through registerErc20, and stETH deposited into a new stETH vault was also counted in the ETH vault's getTotalAssetBalance(ETH). The same stETH therefore backed both rsvETH and rsvstETH shares at once. The vault's 2% withdrawal cap did not stop it.
Attacker: 0x70f2333d21ed7e7d105f6578227a9a747687982c
Attack tx: 0xe3cba90e865c6cba950ebce36a52607f51f1fd33cd9fb920c78803f19b57791a
How it happened
- The attack contract flash-borrowed about 1,139.6 WETH from Balancer.
- It deposited into the RedSonic ETH vault, minting about 1,118 rsvETH, which ExVul described as roughly 99% of the vault's shares.
- It used the unrestricted
registerErc20path to create a stETH vault (rsvstETH) and deposited about 9.34 stETH into it, minting about 9.34 rsvstETH. - Because
getTotalAssetBalance(ETH)also counted that stETH, the rsvETH share price rose. The attacker redeemed rsvETH for more ETH than it had put in. - It then redeemed rsvstETH to get the same stETH back, swapped it on Curve, repaid Balancer and kept about 9.25 ETH.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
