ValueDefi Hack

TOTAL LOST $7.4M

Medium Nov 14, 2020 Flash Loan Attacks Ethereum

What happened

Value DeFi's unaudited MultiStables v2 vault was exploited through a flash-loan-assisted manipulation of Curve's 3pool. The vault's converter derived 3CRV value through a manipulable USDC reserve path. By draining USDC liquidity from the pool, the attacker made the vault overvalue its bCRV and cCRV holdings, then redeemed newly minted vault shares for a disproportionate amount of 3CRV.

The attacker repaid the flash liquidity, returned 2 million DAI to the Value DeFi deployer, and retained approximately 5.4 million DAI.

Technical Root Cause

The MultiStables v2 converter used a Curve AMM exchange rate as an oracle in its bCRV and cCRV to 3CRV conversion path. That path went through USDC, so temporary depletion of Curve 3pool USDC reserves made the vault calculate an artificially high 3CRV value. Deposits entering through MultiVaultBank also bypassed the vault's smart-contract-entry restriction.

Case & protocol details

Classification Oracle Manipulation / Token and Share Accounting

Protocol Type DEX

Affected asset / contract VALUE

Smart Contract Language Solidity

Official Website valuedefi.io/

Protocol Twitter/X @value_defi

Attacker Address 0xa773603b139Ae1c52D05b35796DF3Ee76D8a9A2F

Exploit Transaction 0x46a03488247425f845…dc7471150a

Attack Timeline

The attacker used an Aave flash loan of 80,000 ETH and a Uniswap V2 flash swap of approximately 116 million DAI. They exchanged borrowed assets, deposited 25 million DAI into Value's MultiStables vault, and then removed most USDC liquidity from Curve's 3pool. The vault's converter valued bCRV and cCRV through that manipulated USDC-to-3CRV path.

The attacker redeemed 24.956 million vault shares for roughly 33.089 million 3CRV instead of the normal approximately 24.956 million 3CRV. They then reversed the trades, burned 3CRV for DAI, repaid Aave and Uniswap, returned 2 million DAI, and retained about 5.4 million DAI. Flash loans supplied execution capital; the root failure was the manipulable share-valuation input.