Flash Loan Strikes Deus DAO's New DEI Lending Market, Netting Attacker $3M

Deus DAO saw its users liquidated after a flash loan attack targeted the project's recently deployed DEI lending contract, with the attacker walking away with an estimated $3 million in profit.

It had been five months since the last flash loan attack covered here — a type of exploit that was once far more frequent.

01Mechanism

The attacker used a flash loan to distort the balance of the Solidex USDC/DEI pool, which Deus Finance's $DEI lending contract relies on as an oracle for collateral valuation. That manipulation pushed a number of user positions into insolvency, at which point the attacker's own contract liquidated them before repaying the flash loan.

Credit: Peckshield

1: Flashloan 9,739,342 DEI via SPIRIT-LP_USDC_DEI

2: Flashloan 24,772,798 DEI out of the sAMM-USDC/DEI pair, the pool used as the price oracle for collateral valuation

3: Liquidate the positions made insolvent by step 2

4: Repay the 24,772,798 DEI borrowed from the sAMM-USDC/DEI pair

5: Burn the liquidated LP token, receiving 5,218,173 USDC plus 5,246,603 DEI

6: Swap the 5,218,173 USDC for 5,170,594 DEI

7: Repay the flashloan, keeping 3,001,552 DEI as profit

Attack transaction: 0xe374495036fac18aa5b1a497a17e70f256c4d3d416dd1408c026f3f5c70a3a9c

02Moving the proceeds

The attacker then transferred 3 million USDC via Multichain, moving it from an FTM address to its ETH equivalent, before routing 1,100 ETH and 200,000 DAI onward to Tornado Cash — bringing the total haul to roughly $3 million.

The project's token, DEUS, fell approximately 40% within the hour following the attack and, despite some recovery, has remained volatile since.

Deus announced plans to reimburse affected users who settle their outstanding DEI debts, returning their liquidated collateral to them.

03Lessons not yet learned

Flash loan season taught even non-technical users why price oracles matter, and security practices across the industry improved as a result of that painful period. It's well established that these kinds of attacks can be avoided by relying on decentralized or TWAP oracles rather than a single manipulable pool.

Given that, the question worth asking is why Deus DAO's lending market wasn't built with stronger oracle protections from the start.