Barley Flash-Bond Share Inflation

function latestAnswer()
    public
    view
    returns (uint256)
{
    return priceFeedPendleLpOracle.latestAnswer()
        * pendleChildToken.totalLpAssets()
        * PRECISION_FACTOR_E18
        / pendleChildToken.totalSupply()
        / PRECISION_FACTOR_E18;
}

This matters because Wise treated the attacker’s inflated lending-share claim over PendlePowerFarmToken as genuine collateral, then translated that claim into ETH value through the oracle path above.

3. Vulnerability Analysis & Root Cause Summary

The vulnerability is an on-chain accounting bug, not a private-key compromise or privileged admin misuse. WiseLending exposed two public paths over the same lending-share system that rounded in opposite directions. The deposit path minted shares conservatively for the user, while the exact-amount withdrawal path burned shares aggressively for the protocol. That asymmetry becomes exploitable once one Wise share is already worth more than one PendlePowerFarmToken unit.

The incident’s invariant is simple: if no external yield is created during the transaction, a same-transaction deposit/withdraw round trip should not increase the number of pool assets represented by pre-existing Wise shares. The observed behavior violated that invariant. After each attacker loop iteration, Wise’s totalDepositShares returned to the prior value, but the pool kept a net surplus of PendlePowerFarmToken, so every remaining share became more valuable. Wise then accepted those inflated shares as collateral and let the attacker borrow real assets from other pools.

4. Detailed Root Cause Analysis

The exploit began with a public Aave flash loan and a public Pendle mint path. The attacker converted the flash-loaned inventory into a large PendlePowerFarmToken balance, then used NFT 8 inside WiseLending as the inflation vessel. Before the geometric ratchet, the attacker first triggered the collapse withdrawal that reset the pool to an extreme one-share state:

WiseLending::withdrawExactShares(8, PendlePowerFarmToken, 10000000000)
emit FundsWithdrawn(... amount: 10000015261, shares: 10000000000 ...)
WiseLending::lendingPoolData(PendlePowerFarmToken) -> (2, 1, 750000000000000000)

That transition is the critical precondition. It left the pool with pseudoTotalPool = 2 and totalDepositShares = 1, meaning one Wise share now represented more than one token unit. From there the attacker repeatedly deposited 2 * pseudoTotalPool - 1 token units so that Wise minted exactly one share, then withdrew exact amount 1, which burned exactly one share and restored the one-share pool while leaving a net token surplus behind.

The trace captures the first round directly:

WiseLending::depositExactAmount(8, PendlePowerFarmToken, 3)
emit FundsDeposited(... amount: 3, shares: 1 ...)
WiseLending::withdrawExactAmount(8, PendlePowerFarmToken, 1)

Repeating that round trip ratcheted the pool upward until the later high-value deposit pushed the pool to the traced state (255310974640195504834, 7). At that point the attacker no longer needed a large number of Wise shares. A fresh helper-owned position could deposit only one Wise share worth of PendlePowerFarmToken and still be valued as substantial collateral.

Wise’s oracle path then converted that manipulated share claim into inflated ETH value. The validator fork run and the incident trace both show Wise invoking cashoutAmount(PendlePowerFarmToken, 1) and then WiseOracleHub::getTokensInETH(...) for roughly 36.472996377170786405 PendlePowerFarmToken units, which produced the collateral headroom used for borrowing.

5. Adversary Flow Analysis

The adversary lifecycle has three stages. First, the EOA deployed helper contract 0x91c49cc7fbfe8f70aceeb075952cd64817f9d82c in transaction 0x33e3c94e8e0359b7a98b74a02454a52fad2a8fb7faee02f888807bc60f688628. Second, in the exploit transaction, that helper called Aave V2 flashLoan, entered Pendle, withdrew 10000015261 units from Wise via NFT 8, and executed the repeated Wise deposit/withdraw ratchet on the PendlePowerFarmToken pool. Third, after collateral inflation, the attacker borrowed multiple assets from WiseLending, swapped enough of them to settle the flash loan, and returned the residual value to the originating EOA.

One of the decisive borrow events in the trace is the helper-owned NFT 9 borrow of 43767595652604943692 wstETH:

WiseLending::borrowExactAmount(9, WstETH, 43767595652604943692)
emit FundsBorrowed(... nftId: 9, token: WstETH, amount: 43767595652604943692 ...)
WstETH::transfer(... to attacker, value: 43767595652604943692)

This confirms that the attack was not merely cosmetic pool manipulation. The inflated collateral was spendable against Wise’s real borrow pools.

6. Impact & Losses

The incident caused direct loss of borrowable assets and collateral inventory from WiseLending. The collected balance-diff artifact records at least the following pool losses during the exploit transaction:

[
  {
    "token_symbol": "wstETH",
    "amount": "104066616635764896511",
    "decimal": 18
  },
  {
    "token_symbol": "USDC",
    "amount": "9000000000",
    "decimal": 6
  },
  {
    "token_symbol": "PendlePowerFarmToken",
    "amount": "10000015262",
    "decimal": 18
  }
]

The attacker EOA’s native ETH balance increased by 177772035197698895925 wei net of gas according to the recorded transaction balance diff. The attack therefore realized both protocol asset depletion and attacker profit.

7. References

1. Exploit transaction 0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31, including metadata, receipt, and focused trace summary.
2. Helper contract deployment transaction 0x33e3c94e8e0359b7a98b74a02454a52fad2a8fb7faee02f888807bc60f688628 and attacker contract profile for 0x91c49cc7fbfe8f70aceeb075952cd64817f9d82c.
3. PendlePowerFarmToken verified source bundle for 0xb40b073d7e47986d3a45ca7fd30772c25a2ad57f.
4. Wise oracle configuration summary for PendlePowerFarmToken and verified source bundle for PendleChildLpOracle.
5. Balance-diff artifact for the exploit transaction, which records the attacker’s ETH profit and WiseLending pool losses.