What happened
Tropykus's Rootstock lending protocol was exploited on 14 June 2023 for roughly $150,000. Independent reporting tied it to the same Compound-v2 redeem-rounding weakness exploited at Hundred Finance: a tiny discrepancy in receipt-share redemption becomes material when an attacker can inflate a market exchange rate. Tropykus paused the application and later said founders and pre-seed funding would replace the reported loss for users.
A redeemUnderlying-style share-burn calculation rounded down in a lending-market state where the exchange rate could be inflated. Conservative rounding, seeded market liquidity, and tests for one-unit residual share balances are essential safeguards.
How it happened
- The available incident evidence identifies the same redeem-counter rounding family as Hundred Finance, but does not publish a Tropykus-specific transaction trace or affected market.
- In the known Compound-v2 pattern, an attacker targets a low-liquidity market, inflates its exchange rate, and redeems underlying through a calculation that rounds the receipt shares to burn down.
- A tiny residual share can then retain exaggerated collateral value and enable a withdrawal or borrow beyond the true collateral.
- This page therefore describes the reported vulnerability family without claiming an unverified flash loan, market, or exact transaction sequence.
Protocol details
Security review history
- Coinspect View report
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
