What happened
On May 5, 2021, an attacker re-initialized Value DeFi's vStake pool, assigned themself the operator role, and set the stake token to an attacker-controlled token. The attacker then used the governance recovery function to drain the original vBSWAP/BUSD LP stake; Rekt reports about $10 million lost.
How it happened
- The attacker called the pool's unprotected initialization path.
- They assigned themself the operator role and replaced the stake-token setting with an attacker-controlled token.
- As the effective pool owner, the attacker called the governance recovery function to extract the original vBSWAP/BUSD LP tokens.
- The LP tokens were redeemed and the proceeds were converted and bridged to Bitcoin.
Protocol details
Classification
Exchange (DEX) / Token & Share Accounting / Access Control
Protocol Type
DEX
Affected asset / contract
VALUE
Implementation language
Solidity
Protocol links
Website
@value_defi
Evidence
- report Post-mortem rekt.news
- report Post-mortem medium.com
- report @FrankResearcher incident report twitter.com
- report @CryptoBethany incident report twitter.com
- report Post-mortem rekt.news
- report Value DeFi - REKT 2 rekt.news
- analysis Website reference peckshield.medium.com
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
