What happened
On June 12, 2023, an attacker exploited Sturdy's Ether market through a read-only-reentrancy manipulation of the Balancer wstETH/WETH LP oracle. Sturdy's post-mortem says 442 ETH was stolen and protocol loss was 504 ETH; contemporaneous estimates of its USD value vary.
How it happened
- The attacker flash-borrowed 110,000 ETH through Aave and obtained Curve stETH plus Balancer wstETH/WETH LP collateral.
- They deposited both assets to Sturdy and borrowed WETH.
- During a read-only-reentrancy manipulation of the Balancer LP price, they set Curve stETH as non-collateral through a function that lacked oracle validation.
- They withdrew that collateral, later liquidated the undercollateralized position, and repaid the flash loan; the sequence was repeatable until market WETH was depleted.
Protocol details
Classification
Ecosystem / Reentrancy / Borrowing and Lending
Protocol Type
Lending
Affected asset / contract
STRDY
Implementation language
Solidity
Protocol links
Website
@SturdyFinance
Security review history
- CertiK View report
Evidence
Proof of concept
1 availableSources
- report Sturdy Exploit Post-mortem sturdyfinance.medium.com
- report Twitter/X Alert twitter.com
- report Twitter/X Alert twitter.com
- report @blocksecteam incident report twitter.com
- report @peckshield incident report twitter.com
- report @SturdyFinance incident report twitter.com
- analysis DeFiLlama defillama.com
- analysis Sturdy Finance Hack Analysis blog.solidityscan.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
