What happened
On August 13, 2024, an attacker took about $1.2 million from Vow's token pools on Ethereum. The address allowed to set rates, usdRateSetter, changed the VOW-to-vUSD rate (usdRate) from 1 to 100. That meant anyone burning VOW through the VSCTokenManager contract got 100 vUSD per token instead of 1. Vow said it was testing the rate setter function and that the rate was back to normal within 15 to 30 seconds. The attack contract had been deployed about 110 days earlier and executed within two blocks of the rate change. CertiK pointed to that timing, and to earlier usdRate changes to 150 in November 2023 and 200 in March 2024, as signs the attacker had been watching for the next rate change.
The exploiter, 0x48de6bf9e301946b0a32b053804c61dc5f00c0c3, drained the VOW, vUSD, WETH and USDT pools. Crypto.news reported swaps worth 452 ETH on Uniswap V2 and said the exploiter still held that ETH. VOW fell about 80% in 24 hours. Vow raised the token's burn rate to 50% to bring circulating supply back toward pre-exploit levels. One of the exploiter's later swaps is 0x4b439b82c8878644cd809cfafa6e5c056518a54ea4df098eb1fed9d1cce5ca5f.
How it happened
usdRateSetter(0xbA1be907...aC7c) changedusdRatefrom 1 to 100.- Within two blocks, the attack contract (
0xB7F221e3...1758) borrowed 1,486,625 VOW from the Uniswap VOW-WETH pool. - It sent the VOW to
VSCTokenManagerto be burned and received 148,662,529 vUSD at the inflated rate. - It swapped the vUSD into the VOW-vUSD pool for about 59 million VOW and repaid 1,490,198 VOW to the pool it had borrowed from.
- The attacker then sold into the remaining pools, taking about 175 ETH, 595k USDT and 5.8 million VOW, roughly $1.2 million in total.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
