Themis Protocol Hack

Reported loss $370K
Arbitrum
Flashloan Price Oracle Attack

What happened

Themis Protocol, an Arbitrum lending protocol, was exploited through manipulation of the price used for a Balancer wstETH/WETH LP position. Security analyses report that the attacker used flash liquidity to distort the pool's balance ratio, causing Themis's LP-price calculation to overvalue a small collateral position. The attacker then borrowed assets beyond the genuine value of that collateral, repaid the flash liquidity, and retained an estimated $365,000 to $370,000 profit.

How it happened

  1. The attacker obtained 22,000 WETH through Aave flash liquidity and a further 18,000 WETH from two Uniswap V3 pools.
  2. They used the capital around Themis's Balancer wstETH/WETH LP collateral and swapped a large WETH amount into wstETH, sharply changing the pool's token balance ratio.
  3. Themis's price-query path valued the LP token from the instantaneous pool token quantities, so the manipulated ratio inflated the reported collateral value.
  4. Using about 54.6 wstETH worth of LP exposure as collateral, the attacker borrowed 317 WETH and other assets.
  5. The attacker swapped back, repaid the flash liquidity in the same transaction, and retained the reported profit.

Protocol details

Classification Ecosystem / Borrowing and Lending / Oracle Manipulation
Protocol Type Lending
Implementation language Solidity
Protocol links Website @ThemisProtocol

Security review history

  • PeckShield 2022-01-11 No public report

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Flash Loan Attacks Oracle Manipulation & Price Manipulation

Same attack technique

Browse all hacks →
Ethereum Makina $4.2M lost Ethereum UwU Lend $3.7M lost Fantom DEUS Finance $17.9M lost BNB Chain Elephant Money $22.2M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes