What happened
On February 27, 2025, an attacker used a donation attack against Venus Protocol's wUSDM market on zkSync Era. wUSDM is Mountain Protocol's ERC-4626 wrapper for the USDM stablecoin, and Venus valued it from the vault's exchange rate. By sending USDM straight into the wUSDM contract, the attacker pushed that rate from about 1.0694 to 1.7641 inside one transaction funded by an Aave flash loan, then liquidated his own position at the inflated price.
Venus was left with $902,159 in bad debt; after $163,757 in liquidation fees the net loss was $716,789, according to the post-mortem written by risk manager Chaos Labs. The attacker netted about 86.72 WETH plus 55,000 wUSDM, roughly $200,000. Venus paused the wUSDM market the same day, set its collateral factor to zero, and Mountain Protocol burned USDM to restore the exchange rate.
The donation vector had been flagged in Venus's 2023 Code4rena audit and dismissed.
How it happened
- The attacker flash-borrowed 2,100 WETH from Aave, deposited it on Venus and borrowed wUSDM across several wallets, about 2.17M wUSDM in total.
- The borrowed wUSDM was posted as collateral from a second wallet to borrow further assets.
- The attacker redeemed 411,021 wUSDM for 439,560 USDM at the 1.0694 rate, then transferred that USDM directly into the wUSDM contract, raising the exchange rate to about 1.7641.
- With the first wallet's wUSDM debt now valued far higher, the attacker liquidated it by repaying 1,882,000 wUSDM and seized 1,493 vWETH, redeemed about 1,498 WETH and borrowed another 162 WETH.
- After repaying the flash loan, the attacker kept about 86.72 WETH and 55,000 wUSDM, leaving Venus with the bad debt.
Protocol details
Security review history
- CertiK View report
Evidence
- report @yonikesel incident report x.com
- report Post-Mortem: wUSDM Donation Attack on Venus ZkSync community.venus.io
- report Venus Protocol - Rekt IV rekt.news
- analysis DeFiLlama defillama.com
- analysis Analysis of $700k oracle manipulation exploit highlights vulnerabilities in DeFi vaults theblock.co
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
