vETH Hack

Reported loss $450K
Ethereum
Other

What happened

On November 14, 2024, vETH was exploited through its factory-mediated liquidity-addition flow. SolidityScan estimated the loss at $450,000, while a later Verichains analysis estimated about $477,000 and identified activity on the vETH-BIF, vETH-Cowbo, and vETH-BOVIN Uniswap V2 pairs. Both analyses identify the vETH contract 0x280a8955a11fcd81d72ba1f99d265a48ce39ac2e and attack contract 0x713d2b652e5f2a86233c57af5341db42a5559dd1.

How it happened

  1. A factory allowed an external liquidity-addition path to call vETH's takeLoan function.
  2. That path borrowed vETH and used a user's paired token to add liquidity to a Uniswap V2 vETH pair.
  3. The liquidity operation increased the pair's constant-product state.
  4. The attacker manipulated that state to obtain vETH without paying the expected cost, repeating the flow across three pairs.

Protocol details

Classification Borrowing and Lending / Oracle Manipulation
Protocol Type Exploit/Other
Implementation language Solidity

Evidence

Understand the attack patterns

Compare incidents →
Oracle Manipulation & Price Manipulation

Same attack technique

Browse all hacks →
NEAR Rhea Finance $18.4M lost BNB Chain BBX Token $12K lost Ethereum Fire Token $24K lost BNB Chain Black Hole $1.3M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes