TheStandard.io Hack

Reported loss $290K

Nov 06, 2023 Arbitrum

Other

What happened

On 6 November 2023 an attacker minted about 280,000 EUROs against a TheStandard.io smart vault on Arbitrum and then swapped away almost all of the vault's real collateral, leaving the EUROs unbacked. The vault's collateral swap passed an amountOutMinimum of 0 to Uniswap V3, so it accepted any price, and the attacker routed the swap through a thin PAXG/WBTC pool they controlled. Losses were reported at about $290K.

TheStandard.io paused new EUROs minting and vault creation and asked the attacker to negotiate as a whitehat. On 8 November the attacker sent about 242,800 EUROs back to TheStandard.io's deployer address.

How it happened

The attacker created a new Uniswap V3 PAXG/WBTC pool and flash-borrowed WBTC.
They opened a smart vault, deposited 10 WBTC as collateral, and minted the maximum EUROs allowed.
They added liquidity to their pool in a tick range that priced WBTC and PAXG at roughly 1:1, heavily overvaluing PAXG.
They called the vault's collateral swap to turn the 10 WBTC into PAXG. The vault sent the trade through the Uniswap V3 router with amountOutMinimum set to 0, so the swap executed at the manipulated price and the vault received PAXG worth far less than its outstanding EUROs.
The attacker removed their liquidity, recovering about 9.9 WBTC, swapped some EUROs to USDC to repay the flash loan, and kept the remaining EUROs.

Protocol details

Classification Stablecoin / Borrowing and Lending / Protocol Logic

Protocol Type Exploit/Other

Affected asset / contract TST

Implementation language Solidity

Protocol links Website @thestandard_io

Funds Recovery

91.0%

Recovered

$264K

Net Loss

$26,100

Evidence

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes