Roe Finance Hack

What happened

Roe Finance lost approximately $80,000 on Ethereum on January 11, 2023 after its lending market accepted an inflated WBTC/USDC LP-token valuation. QuillAudits traced the successful extraction to an MEV bot that front-ran the original exploit attempt.

Technical root cause

The lending market trusted an LP-token valuation that could be increased through reserve manipulation, allowing the same transaction's temporary liquidity to raise borrowing power.

How it happened

1. The successful transaction borrowed USDC through a Balancer flash loan and deposited it into the lending market.
2. Repeated borrowing and redepositing built an LP-token position. The attacker then removed liquidity and donated USDC to the underlying pair.
3. Calling sync() incorporated the donation into reserves, inflating the LP collateral valuation used by the lender.
4. The inflated borrowing limit allowed further USDC extraction. The transaction repaid its flash loan and retained WBTC and USDC.

QuillAudits distinguishes the failed original attempt from the successful front-running transaction linked below.

Protocol details

Classification LP collateral price manipulation

Protocol Type Lending

Protocol links Website @RoeFinance

Exploit Transaction 0x927b784148b60d5233…aeaa98985b

Evidence

• report @spreekaway incident report twitter.com
• report @BlockSecTeam incident report twitter.com
• transaction Roe Finance: successful front-running transaction etherscan.io
• analysis QuillAudits: Roe Finance LP valuation exploit quillaudits.medium.com
• analysis DeFiLlama defillama.com

Understand the attack patterns

Compare incidents →

Flash Loan Attacks Oracle Manipulation & Price Manipulation