What happened
On October 4, 2022, an attacker exploited Sovryn's iRBTC and iUSDT lending pools on Rootstock. The exploit used cross-contract reentrancy to manipulate the iToken price, allowing the attacker to mint pool tokens at a discount and redeem them at an inflated value. Sovryn paused the affected system, deployed a fix, and said all funds removed from the lending pools were returned through recovered assets and treasury coverage.
How it happened
- The attacker borrowed from a lending pool and began closing the position.
- During a refund transfer, a fallback or token hook reentered the lending-pool mint path before principal returned to the pool.
- The temporarily understated pool balance made the iToken price too low, so the attacker minted iTokens at a discount.
- When the close resumed and principal returned, the iToken price rose; the attacker then redeemed the iTokens for inflated value.
Protocol details
Funds Recovery
Recovered
$539K
Net Loss
$561,000
Evidence
- report Report halborn.com
- report @BeosinAlert incident report twitter.com
- report Lending Pool Exploit Postmortem: October 2022 sovryn.com
- analysis Website reference sovryn.app
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
