What happened
Tropykus's Rootstock lending protocol was exploited on 14 June 2023 for roughly $150,000. Independent reporting tied it to the same Compound-v2 redeem-rounding weakness exploited at Hundred Finance: a tiny discrepancy in receipt-share redemption becomes material when an attacker can inflate a market exchange rate. Tropykus paused the application and later said founders and pre-seed funding would replace the reported loss for users.
A redeemUnderlying-style share-burn calculation rounded down in a lending-market state where the exchange rate could be inflated. Conservative rounding, seeded market liquidity, and tests for one-unit residual share balances are essential safeguards.
Case & protocol details
Attack Timeline
The available incident evidence identifies the same redeem-counter rounding family as Hundred Finance, but does not publish a Tropykus-specific transaction trace or affected market. In the known Compound-v2 pattern, an attacker targets a low-liquidity market, inflates its exchange rate, and redeems underlying through a calculation that rounds the receipt shares to burn down. A tiny residual share can then retain exaggerated collateral value and enable a withdrawal or borrow beyond the true collateral.
This page therefore describes the reported vulnerability family without claiming an unverified flash loan, market, or exact transaction sequence.
Security review history
- Coinspect Report
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report twitter.com
- report Post-mortem rekt.news
- code Code reference github.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.