TranchePool Hack

On October 28, 2026, a TranchePool on the Avalanche C-Chain (associated with Valinor Digital, Oatfi, and Fence Finance) was drained of its entire USDC balance, totaling $1,013,353.61, due to a time-dependent credit accounting flaw in its daily rollover logic.

The exploit relied on a flaw in the pool's automated settlement logic (_rollover()) that processed scheduled principal payments at the UTC day rollover by treating a scheduled due date as an actual cash-received payment, reducing outstandingPrincipal without verifying that USDC had arrived. Executing via a helper contract (0xf09dcf4e…a57805), the attacker took a flash loan of 1,013,353.61 USDC from Aave v3 at 23:56:41 UTC on October 27, interacted with the TranchePool (0xe25cb545...), repaid Aave with a premium, and scheduled a principal repayment for midnight UTC. At 00:00:00 UTC on October 28, the rollover marked the scheduled payment as settled, lowering outstanding principal by ~1.013M USDC on paper; three seconds later at 00:00:03 UTC, the attacker re-called the draw path using identical calldata, successfully withdrawing the pool's remaining 1,013,353.61 USDC because capacity had been artificially restored.

The stolen funds were quickly laundered off Avalanche via Circle's CCTP (depositForBurnWithHook), bridging ~250,000 USDC and ~763,375 USDC to Solana (Domain 5), after which Fence Finance issued an on-chain message offering a 10% bounty for the return of 90% of the funds.

Vulnerable TranchePool Address: 0xe25cb545…47621a

Attacker Wallet: 0x6ff1c3ff…2b1246

Attacker Helper Contract: 0xf09dcf4e…a57805