Ref Finance Hack

Reported loss $3.2M
NEAR
LP balance not debited

What happened

Ref Finance reported that a hotfix introduced an LP-accounting bug that allowed repeated liquidity withdrawals. Its postmortem records 507,000 NEAR and approximately one million REF withdrawn through the flaw. The team paused contracts, coordinated exchange freezes and funded reimbursements.

Technical root cause

Liquidity withdrawals did not debit the user's LP-token balance after a hotfix.

How it happened

  1. A hotfix addressed a withdrawal problem associated with NEAR account unregistration after unstaking.
  2. The new code failed to debit LP-token balances when liquidity was removed.
  3. Users could reuse the same LP balance to withdraw more pool assets.
  4. Ref paused the contracts and website, contacted exchanges and arranged reimbursement using protocol and DAO funds.

Protocol details

Classification Protocol Logic / Accounting Error
Protocol Type Exploit/Other
Affected asset / contract REF
Implementation language Rust
Protocol links Website @finance_ref

Evidence

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes