Calculated from recorded token losses using historical USD prices at the incident time.
0xfd36e2c2a6789db23113685031d7f16329158384BSC0x86e06eafa6a1ea631eab51de500e3d474933739fBSC0xa07c5b74c9b40447a954e1466938b865b6bbea36BSC0x86ac3974e2bd0d60825230fa6f355ff11409df5cBSC0xeca88125a5adbe82614ffc12d0db554e2e2867c8BSC0x882c173bc7ff3b7786ca16dfed3dfffb9ee7847bBSCOn BSC, an attacker-controlled cluster used a pre-existing vTHE position, direct THE donations into the Venus vTHE market, and recursive borrowing to create artificial collateral value and extract debt from Venus. The opening transaction was 0x4f477e941c12bbf32a58dc12db7bb0cb4d31d41ff25b2457e6af3c15d7f5663f at block 86731941, followed by helper and borrower donation loops, and the first liquidation appeared in 0xb72c9e9932f42dfa7a0bbbc5166fccbf7c55a5f8d0434ac2fe38a86451fa073a at block 86738473.
The root cause is a protocol accounting failure in Venus. vTHE treated unsolicited underlying transfers as additional market cash inside exchangeRateStored, and Venus then multiplied that inflated exchange rate by the borrower’s unchanged vTHE share balance during liquidity checks. That let the attacker create new borrow capacity without minting new collateral shares.
The ACT framing is deterministic at pre-state sigma_B, defined as BSC mainnet immediately before block 86731941 with the attacker’s pre-existing vTHE position, the borrower’s pre-existing delegate approval, and the donor EOAs’ pre-existing THE allowances to the attacker helper contract. The chosen success predicate is non-monetary: the exploit is successful if direct THE donations inflate Venus collateral enough to create shortfall and leave unpaid debt after public liquidations. Profit valuation is intentionally not part of this predicate.
Venus values collateral using each entered market’s vToken balance, exchange rate, oracle price, and collateral factor. For vTHE, the share token balance is separate from the underlying THE balance held by the vTHE contract.
Direct ERC20 transfers into a vToken do not mint new shares. They only increase the raw underlying balance at the market contract address. If exchange-rate logic reads that raw balance directly, existing share holders can appear richer without receiving additional shares.
0x7e28322a255978e7e8d105740f646faab79cffcf6dbccefc903c77dfd139a8590xcffe2e119e0c69ed582de2e67ea162f5d80372c3d019bcd72ea2374db8e923d30xb72c9e9932f42dfa7a0bbbc5166fccbf7c55a5f8d0434ac2fe38a86451fa073aThe relevant public components were all live and permissionless during the incident:
| Component | Address | Role |
|---|---|---|
| Venus Unitroller | 0xfd36e2c2a6789db23113685031d7f16329158384 | Core protocol controller |
| vTHE | 0x86e06eafa6a1ea631eab51de500e3d474933739f | Inflated collateral market |
| vBNB | 0xa07c5b74c9b40447a954e1466938b865b6bbea36 | Borrowed market in the traced recursive loop |
| vCAKE | 0x86ac3974e2bd0d60825230fa6f355ff11409df5c | Borrowed market |
| vUSDC | 0xeca88125a5adbe82614ffc12d0db554e2e2867c8 | Borrowed market |
| vBTC | 0x882c173bc7ff3b7786ca16dfed3dfffb9ee7847b | Borrowed market |
| THE | 0xf4c8e32eadec4bfe97e0f595add0f4450a863a11 | Underlying donated asset |
The attacker exploited four conditions that were simultaneously true:
vTHE without minting offsetting vTHE shares.This incident is an ATTACK, not a pricing glitch or liquidation-only MEV event. Venus’s collateral engine allowed raw underlying donations to reprice existing vTHE shares because exchangeRateStoredInternal counted the vTHE contract’s underlying cash balance directly. The borrower’s share count did not increase, but the exchange rate did, so liquidity checks concluded that the borrower had more collateral than was economically backed by minted shares.
The critical invariant is: a user’s borrow limit should increase only when the user receives more economically backed collateral shares or when a legitimate oracle price move revalues those shares. Arbitrary direct underlying transfers into the market must not increase collateral value for existing share holders without minting new shares.
The code-level breakpoint is the handoff from vTHE exchange-rate computation into Venus liquidity evaluation. Verified Venus source shows the two relevant pieces:
Verified Venus VToken source:
function exchangeRateStoredInternal() internal view virtual returns (MathError, uint) {
uint _totalSupply = totalSupply;
if (_totalSupply == 0) {
return (MathError.NO_ERROR, initialExchangeRateMantissa);
} else {
uint totalCash = _getCashPriorWithFlashLoan();
(mathErr, cashPlusBorrowsMinusReserves) = addThenSubUInt(totalCash, totalBorrows, totalReserves);
(mathErr, exchangeRate) = getExp(cashPlusBorrowsMinusReserves, _totalSupply);
return (MathError.NO_ERROR, exchangeRate.mantissa);
}
}
Verified Venus PolicyFacet source:
(Error err, , uint256 shortfall) = getHypotheticalAccountLiquidityInternal(
borrower,
VToken(vToken),
0,
borrowAmount,
WeightFunction.USE_COLLATERAL_FACTOR
);
if (shortfall != 0) {
return uint256(Error.INSUFFICIENT_LIQUIDITY);
}
getHypotheticalAccountLiquidityInternal delegates the valuation to ComptrollerLens.getHypotheticalAccountLiquidity, so the inflated vTHE exchange rate becomes borrow power. That is the deterministic mechanism reported in root_cause.json, and it is consistent with the collected code and on-chain evidence.
The pre-state evidence shows the attacker did not need privileged protocol access. Before the seed transaction, the borrower 0x1a35bd28efd46cfc46c2136f878777d69ae16231 had already approved helper contract 0x737bc98f1d34e19539c074b8ad1169d5d45da619 as a Venus delegate, and six donor EOAs had already granted that helper effectively infinite THE allowances. Pre-state checks at block 86731940 also show the borrower already held 1212899224901437 vTHE and had positive Venus liquidity of 508573548813799729021482.
The seed transaction established the first deterministic jump. The balance diff for 0x4f477e94... shows that the vTHE contract’s THE balance increased by exactly 36096716105623166306174220, while donor EOAs and the borrower lost matching THE balances. No new vTHE shares were minted to the borrower during that direct donation. Immediately after the seed, pre-state checks show:
{
"block": 86731940,
"exchange_rate_stored": "10086934836048682272253246082",
"borrower_account_liquidity": { "liquidity": "508573548813799729021482", "shortfall": "0" }
}
{
"block": 86731941,
"exchange_rate_stored": "38420106437951196125686577050",
"borrower_account_liquidity": { "liquidity": "1368779122696366507521762", "shortfall": "0" }
}
That jump is the invariant violation in measurable form: unchanged shares, much higher exchange rate, and much higher borrow capacity.
The attacker then compounded the effect in two public loops. Helper-contract transactions such as 0x6042ab57dbb52e70579a44664e128babf34ddf95b323f3e61f4a2721c8c446b7 repeatedly swapped CAKE into THE and transferred the output directly into vTHE. Borrower-side transactions such as 0xcffe2e119e0c69ed582de2e67ea162f5d80372c3d019bcd72ea2374db8e923d3 wrapped borrowed BNB to WBNB, swapped WBNB into THE, and donated that THE directly into vTHE.
The traced borrow 0x7e28322a255978e7e8d105740f646faab79cffcf6dbccefc903c77dfd139a859 shows the downstream effect on Venus credit. At that point the inflated vTHE snapshot, THE oracle price 524589160000000000, and effective LTV 530000000000000000 still produced hypothetical liquidity of 150128726902695436747528, so one more 100 BNB borrow succeeded. The recursive loop continued until block 86738472, where pre-state checks show liquidity had fallen to zero and shortfall had become 217635227636271995373760.
The exploit’s success predicate is non-monetary and is fully satisfied by post-liquidation evidence. The first liquidation arrived in block 86738473, but liquidation did not heal the account. The collected closure summary at block 86750000 still shows shortfall 1731937327669065945227401 and non-zero unpaid debt across vBNB, vCAKE, vUSDC, and vBTC. That proves this was a real solvency failure, not a transient accounting artifact.
The attacker strategy was a multi-account donation-inflation attack that used one deployer EOA, one helper contract, one delegated borrower EOA, and several donor EOAs.
| Address | Type | Role in the attack |
|---|---|---|
0x43c743e316f40d4511762eedf6f6d484f67b2f82 | EOA | Deployed the helper contract and sent all helper follow-up transactions |
0x737bc98f1d34e19539c074b8ad1169d5d45da619 | Contract | Helper contract that received borrowed assets, executed CAKE-to-THE donation calls, and consumed pre-existing approvals |
0x1a35bd28efd46cfc46c2136f878777d69ae16231 | EOA | Delegated borrower that carried the debt and executed the recursive VBNB and WBNB-to-THE loop |
0xf052219f767612c411c9fe4a0f334237429c58aa | EOA | Seed donor |
0x89e3615f356b3b40acb2f8598117eab1affdddb6 | EOA | Seed donor |
0xbb3782048735091ab4c304693a69371965a4ef87 | EOA | Seed donor |
0x564a073fa4cfa81c2c882168fa760a88b82a4591 | EOA | Seed donor |
0x16f09b91604053e742ee0408909bafa6a825bf07 | EOA | Seed donor |
| Index | Tx hash | Type | Inclusion feasibility | Notes |
|---|---|---|---|---|
| 1 | 0x4f477e941c12bbf32a58dc12db7bb0cb4d31d41ff25b2457e6af3c15d7f5663f | Adversary-crafted | An unprivileged EOA deployed a helper contract and called only public ERC20, DEX-router, and Venus-market functions | Donated 36096716105623166306174220 THE to vTHE and borrowed USDC, CAKE, and WBNB |
| 2 | 0x6042ab57dbb52e70579a44664e128babf34ddf95b323f3e61f4a2721c8c446b7 | Adversary-crafted | Ordinary follow-up calls from the deployer EOA into its own helper contract | Representative of 48 helper calls that swapped CAKE into THE and donated to vTHE |
| 3 | 0x7e28322a255978e7e8d105740f646faab79cffcf6dbccefc903c77dfd139a859 | Adversary-crafted | Public Venus borrow calls using attacker-controlled delegate setup already present in sigma_B | Representative of 52 VBNB borrows |
| 4 | 0xcffe2e119e0c69ed582de2e67ea162f5d80372c3d019bcd72ea2374db8e923d3 | Adversary-crafted | Public WBNB and router swap calls with output sent to vTHE | Representative of 33 borrower-side WBNB-to-THE donation swaps |
| 5 | 0xb72c9e9932f42dfa7a0bbbc5166fccbf7c55a5f8d0434ac2fe38a86451fa073a | Victim-observed | Public liquidators entered once the account became undercollateralized | First liquidation in a run of 7093 liquidation transactions |
0x4f477e94... deployed the helper contract, drained THE from pre-approved donors, transferred the donated THE directly into vTHE, and extracted USDC, CAKE, and WBNB borrow proceeds while leaving the debt on the delegated borrower.0x4a2430a2... and 0x6042ab57... repeatedly swapped CAKE into THE and transferred the THE directly into vTHE without minting new vTHE shares.0x7e28322a... and 0xcffe2e11... borrowed 100 BNB, wrapped it, swapped it into THE, and donated the THE into vTHE, ratcheting exchange rate and liquidity upward until the borrower crossed into shortfall.The affected victim-side protocol components were the Venus Unitroller, vTHE, and the borrow markets vBNB, vCAKE, vUSDC, and vBTC. The violated security principles were straightforward: collateral-share accounting must not let arbitrary donations create new borrow capacity, and liquidity checks must not trust exchange rates derived from permissionlessly manipulable raw balances.
The measurable losses captured in the final bad-debt snapshot are:
| Token | Amount (raw units) | Decimals |
|---|---|---|
| CAKE | 1183953575130399330641512 | 18 |
| USDC | 2328411564476595347 | 18 |
| BNB | 9260384180511972 | 18 |
| BTCB | 960478259272573 | 18 |
The borrower’s health deterioration is also explicit in the evidence:
86731940.1368779122696366507521762 immediately after the seed donation.86738472, shortfall had become 217635227636271995373760.1731937327669065945227401 at block 86750000.The first liquidation was 0xb72c9e9932f42dfa7a0bbbc5166fccbf7c55a5f8d0434ac2fe38a86451fa073a, which repaid CAKE debt and seized vTHE collateral. The last recorded liquidation in the collected window was 0x2c331bdab58dcbf9779a12d8516b08f2b93a21616326886a84367c4a5be1790a. Despite that liquidation activity, bad debt remained across vCAKE, vUSDC, vBNB, and vBTC.
0x4f477e941c12bbf32a58dc12db7bb0cb4d31d41ff25b2457e6af3c15d7f5663f86731940 and later checkpoints showing vTHE exchange-rate and liquidity growth0x6042ab57dbb52e70579a44664e128babf34ddf95b323f3e61f4a2721c8c446b70xcffe2e119e0c69ed582de2e67ea162f5d80372c3d019bcd72ea2374db8e923d30x7e28322a255978e7e8d105740f646faab79cffcf6dbccefc903c77dfd139a8590x3c115aa5800a589d1e0c3163f3f562d5544f060fhttps://bscscan.com/address/0x732138e18fa6f8f8e456ad829db429a450a79758#code0x1a35bd28efd46cfc46c2136f878777d69ae16231, including liquidation counts, first liquidation, and residual debt snapshot