ValueDefi Hack
What happened
Value DeFi's unaudited MultiStables v2 vault was exploited through a flash-loan-assisted manipulation of Curve's 3pool. The vault's converter derived 3CRV value through a manipulable USDC reserve path. By draining USDC liquidity from the pool, the attacker made the vault overvalue its bCRV and cCRV holdings, then redeemed newly minted vault shares for a disproportionate amount of 3CRV.
The attacker repaid the flash liquidity, returned 2 million DAI to the Value DeFi deployer, and retained approximately 5.4 million DAI.
The MultiStables v2 converter used a Curve AMM exchange rate as an oracle in its bCRV and cCRV to 3CRV conversion path. That path went through USDC, so temporary depletion of Curve 3pool USDC reserves made the vault calculate an artificially high 3CRV value. Deposits entering through MultiVaultBank also bypassed the vault's smart-contract-entry restriction.
How it happened
The attacker used an Aave flash loan of 80,000 ETH and a Uniswap V2 flash swap of approximately 116 million DAI. They exchanged borrowed assets, deposited 25 million DAI into Value's MultiStables vault, and then removed most USDC liquidity from Curve's 3pool. The vault's converter valued bCRV and cCRV through that manipulated USDC-to-3CRV path.
The attacker redeemed 24.956 million vault shares for roughly 33.089 million 3CRV instead of the normal approximately 24.956 million 3CRV. They then reversed the trades, burned 3CRV for DAI, repaid Aave and Uniswap, returned 2 million DAI, and retained about 5.4 million DAI. Flash loans supplied execution capital; the root failure was the manipulable share-valuation input.
Protocol details
Funds Recovery
Recovered
$2.0M
Net Loss
$5,402,000
Evidence
- report Post-mortem rekt.news
- report @FrankResearcher incident report twitter.com
- report Value DeFi MultiStables Vault Exploit Post-Mortem valuedefi.medium.com
- transaction Value DeFi Exploit Transaction etherscan.io
- analysis DeFiLlama defillama.com
- analysis Value DeFi Incident Root-Cause Analysis peckshield.medium.com
- analysis Value DeFi MultiStablesVault Exploit aftermath.digital
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
