What happened
On September 21, 2021, Vee Finance’s leveraged-trading system was exploited on Avalanche for approximately $35 million, including about 8,804.7 ETH and 213.93 BTC. The protocol’s pricing path relied on thin Pangolin liquidity and a single-source oracle.
Technical root cause
Vee’s oracle refreshed a cached price when the Pangolin spot price moved beyond a small threshold, without a robust independent reference. Decimal handling and slippage assumptions further amplified the discrepancy. The reviewed forensic analysis says the attacker self-funded rather than using a flash loan.
How it happened
- The attacker funded and deployed contracts on Avalanche.
- Attacker-controlled Pangolin pairs were created or supplied with liquidity to establish manipulable prices.
- Trades moved the pool price beyond Vee’s oracle refresh threshold.
- Vee consumed the manipulated price for leveraged positions and the attacker extracted ETH and BTC from the trading vaults.
Protocol details
Classification
Ecosystem / Borrowing and Lending / Oracle Manipulation
Protocol Type
Lending
Affected asset / contract
VEE
Implementation language
Solidity
Protocol links
Website
@VeeFinance
Security review history
- CertiK No public report
- SlowMist No public report
Evidence
- analysis Vee Finance official attack analysis veefi.medium.com
- analysis Website reference veefi.medium.com
- analysis Website reference beincrypto.com
- analysis DeFiLlama defillama.com
- analysis Vee Finance exploit analysis immunebytes.com
- analysis Vee Finance oracle manipulation case study onchainattack.org
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
