What happened
On November 2, 2021, Vesper Lend beta on Rari Fuse Pool #23 was exploited after VUSD's price was manipulated upward. Vesper reported that the attacker used inflated VUSD collateral to borrow roughly $3.5 million in assets. The incident affected Pool #23 depositors, while Vesper's listed Grow and Earn pools and VUSD holders were not negatively affected.
How it happened
- The attacker obtained ETH, swapped part of it for USDC, and bought available VUSD in the Uniswap v3 0.05% pool.
- The attacker created a 0.1-USDC Uniswap v3 liquidity position at an extreme VUSD/USDC price, causing the oracle to report a price in the trillions for that fee range.
- Rari Fuse Pool #23 used that oracle price and valued VUSD collateral at an effectively unlimited value.
- The attacker supplied VUSD as collateral and borrowed roughly $3.5 million in available assets.
- Vesper paused VUSD and vVSP borrowing on Pool #23 and set VUSD's collateral factor to zero while investigating.
Protocol details
Evidence
- report @VesperFi incident report x.com
- report On the Vesper Lend Beta / Rari Fuse Pool #23 Exploit medium.com
- report @mudit__gupta incident report twitter.com
- report @RariCapital incident report twitter.com
- analysis DeFiLlama defillama.com
- analysis Manipulation of Oracles: Analysis of VesperLend being hacked sharkteam.org
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
