vETH Hack

On November 14, 2024, the vETH token suffered an exploit caused by a flaw in the business logic of its smart contract, resulting in a loss of approximately $450,000.

The vulnerability stemmed from a flaw in the vETH token’s takeLoan function, which could be triggered by an authorized factory contract. This factory contract was meant to add liquidity to the Uniswap vETH-BIF pair using borrowed vETH and the user’s BIF tokens. However, the attacker manipulated the liquidity pool during this process by borrowing vETH without proper constraints.

This allowed them to alter the pool's constant (x * y = k) and drain vETH without incurring the full cost, leading to substantial financial losses.

Attacker:

https://etherscan.io/address/0x713d2b65…559dd1

Victim contract:

https://etherscan.io/address/0x280a8955…39ac2e#code