What happened
In June 2026, Thetanuts Finance reported an exploit affecting a Legacy Index Vault on Ethereum. Security reporting estimated about $2.1 million in option-token value was exposed. The available analyses attribute the attack to a flash-loan-assisted rounding error in the vault's minting or share calculation.
A rounding or integer-division error in legacy vault accounting could be amplified with flash liquidity. Share and mint calculations must explicitly define rounding direction and be tested at extreme ratios and atomic deposit/withdrawal boundaries.
How it happened
Public incident reporting describes an attacker using a flash loan to exploit an integer-division or rounding edge case in the legacy vault's accounting. The faulty calculation allowed option-token exposure to be minted or obtained at a cost that did not match its economic value. A later community analysis reported that whitehats recovered a substantial portion of the exposed assets, but this page does not state a recovered amount because that figure is not corroborated by the primary project statement in the source set.
The incident is a reminder that vault math is security-critical: rounding direction, precision, and the order of accounting updates must hold even when capital is supplied atomically.
Protocol details
Market Context at Time of Hack
Security review history
- ConsenSys Diligence View report
- PeckShield View report
- Halborn View report
- Zokyo View report
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
