What happened
On July 11, 2023, an attacker manipulated Rodeo Finance's TWAP oracle for an unreleased ETH-unshETH CLP strategy using a multiblock sandwich attack. The protocol's postmortem reports $1.7 million used in the manipulation, $816,342 recovered as unshETH, and an approximately $880,000 net exploit loss.
How it happened
- The attacker manipulated the four-sample TWAP used by the ETH-unshETH strategy through a multiblock sandwich attack.
- Rodeo Farms used the manipulated oracle for LP pricing.
- The false valuation bypassed the Health Factor check, allowing positions funded by borrowing from the USDC Pool.
- The attacker made large swaps in the Camelot pair, then performed equal-sized swaps in the opposite direction to capture the arbitrage.
- Rodeo paused its Farms and Lending Pool, disabled farms with TWAP-backed feeds, and recovered unshETH left in the exploit path.
Protocol details
Classification
Yield Aggregator
Protocol Type
Exploit/Oracle Issue
Affected asset / contract
RDO
Protocol links
Website
@Rodeo_Finance
Security review history
Funds Recovery
Recovered
$810K
Net Loss
$880,490
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
