What happened
Sonne Finance on Optimism lost approximately $20 million through a known Compound V2 donation attack after a permissionless timelock window exposed a newly created, empty market before its intended initialization safeguards ran.
A permissionless timelock execution path exposed a new empty Compound V2-style market before Sonne's initialization controls could run. Direct donations inflated totalCash without corresponding share supply, and redeemUnderlying rounded required shares down, enabling withdrawal with too few shares.
Case & protocol details
Attack Timeline
When a two-day timelock expired, the attacker executed queued market-creation and collateral-factor transactions, leaving the new VELO market exploitable. They donated borrowed VELO to an almost empty soVELO market without minting shares, inflating its exchange rate while total supply stayed at 2 wei.
Rounding in redeemUnderlying then allowed a large VELO redemption for only 1 wei of soVELO. The attacker borrowed against the inflated collateral and repeated against other markets. Flash liquidity aided execution, but the core flaw was empty-market share inflation and precision loss.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report x.com
- report Report x.com
- report Post-mortem medium.com
- report Post-mortem medium.com
- transaction Transaction optimistic.etherscan.io
- analysis Sonne Finance Incident Analysis certik.com
- analysis BlockSec May 2024 Security Review blocksec.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.