Resupply Hack

Reported loss $10.0M
Ethereum
Empty-vault donation and inverse-rate rounding to zero

What happened

Resupply's newly deployed Ethereum crvUSD-wstUSR lending pair was exploited about 95 minutes after deployment. The protocol's official postmortem timestamps the exploit at 01:53 UTC on June 26, 2025; the source record's June 25 date reflects a different reporting time zone. The attack created $10 million in reUSD bad debt by making a borrower's loan-to-value calculation resolve to zero.

Technical root cause

A collateral-share manipulation could make the oracle price exceed the numerator of an inverse exchange-rate calculation, causing integer division to round the rate to zero. That zero value then disabled the solvency invariant. Protocols must reject zero or otherwise invalid exchange rates before risk calculations, and must harden empty-vault share-accounting paths against donation manipulation.

How it happened

  1. The underlying CurveLend vault had no deposits.
  2. The attacker donated 2,000 crvUSD to its controller, then deposited about 2 crvUSD to mint one unit of vault-share collateral.
  3. That made convertToAssets(1e18) return 2e36.
  4. Resupply's inverse exchange-rate calculation, exchangeRate = 1e36 / price, then rounded down to zero.
  5. Its borrow check multiplied the debt by that zero rate, producing a zero LTV and treating the borrower as solvent regardless of the actual debt.
  6. The attacker borrowed the pair's full 10 million reUSD limit and swapped the reUSD externally.

Protocol details

Classification ERC-4626 Share Inflation / Zero-Rate Solvency Bypass
Protocol Type Lending
Implementation language Solidity
Protocol links Website @ResupplyFi
Exploit Transaction 0xffbbd492e0605a8bb6…11e7a872d3

Market Context at Time of Hack

Token Price at Hack $1.58
Market Cap at Hack $8.0M
Reported loss / token market cap 100.00%

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Oracle Manipulation & Price Manipulation

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes