How a Two-Hour-Old Vault Cost Resupply $9.8 Million

On June 25th, Resupply launched a new lending market with the usual fanfare of governance votes and audit sign-offs. Within roughly two hours of that market going live, an attacker had drained $9.8 million from it using a well-documented but still-devastating technique: the ERC4626 donation attack.

By the time the security community had finished tweeting about the damage, the funds were already gone.

A known attack pattern, not a novel one

Nothing about this exploit required unusual sophistication. It was a textbook donation attack against a freshly deployed, effectively empty vault — the kind of vulnerability that has been publicly documented for years. Resupply had passed governance checks and carried audit reports, yet had no defense against an attacker seeding the vault with a trivial deposit and using it to distort the protocol's exchange-rate math.

Timeline of the disclosure

BlockSec's Phalcon monitoring system was first to flag the attack, posting that it had detected a transaction against Resupply causing roughly $9.8 million in losses. PeckShield corroborated the finding shortly after. By the time both firms had published their assessments, the attacker had already finished executing the exploit and moved the funds onward.

BlockSec characterized the root cause bluntly: exchange-rate manipulation on a low-liquidity, essentially empty market — a recurring failure mode across lending protocols.

Two hours after the incident was first reported publicly, Resupply issued its own statement, confirming an exploit in the wstUSR market and noting that the affected contract had been identified and paused — after the $9.8 million had already left the protocol.

How the exchange-rate math broke

According to on-chain analysis by Chaofan Shou, the targeted cvcrvUSD vault had only been live for about two hours before the attack — not nearly long enough to accumulate real deposits.

Beosin and TenArmor documented the mechanics: the attacker sent 2,000 crvUSD directly to the vault's controller contract, then minted a single wei of shares. That combination inflated the implied share price to an extreme degree, breaking Resupply's exchange-rate calculation (further detailed in CoinsBench's technical writeup).

Tony Ke's analysis traced the failure to Resupply's rate formula, 1e36 divided by the oracle's reported price. When the oracle correctly returned the now-massively inflated vault price (2×10^36), that division rounded down to zero under Solidity's integer/floor-division rules.

With the exchange rate at zero, the resulting loan-to-value calculation also collapsed to zero, effectively removing any limit on how much could be borrowed against a given amount of collateral.

OKX Explorer's data shows the attacker then deposited a single wei of cvcrvUSD as collateral and borrowed $10 million in reUSD — essentially all of the protocol's available liquidity. As Cyvers explained to Decrypt, the manipulated price triggered the zero-exchange-rate bug, letting the attacker borrow a large sum against almost nothing.

Tracing the attacker

The operation was funded via Tornado Cash. From there, CoinsBench's breakdown notes that the attacker deployed two purpose-built contracts at the start of the exploit transaction:

• A simple ETH-receiving helper contract: 0xf90da523a7c19a0a3d8d4606242c46f1ee459dc7
• The main exploit contract that orchestrated the attack: 0x151aa63dbb7c605e7b0a173ab7375e1450e79238

Funds ended up split across attacker-controlled addresses:

• Primary address: 0x6D9f6E900ac2CE6770Fd9f04f98B7B0fc355E2EA
• Second address, holding roughly $5.5 million: 0x31129a5c13306A48E827e851D44E19Ca07d4928A
• Third address, holding roughly $3.9 million: 0x886f786618623ffFB2be59830A47661Ae6492E16

CertiK's data puts the split at approximately $5.5 million to one wallet and $4 million to the other — a distribution that could indicate profit-sharing or simply an attempt at more resilient laundering.

Relevant on-chain references:

• Exploit transaction: 0xffbbd492e0605a8bb6d490c3cd879e87ff60862b0684160d08fd5711e7a872d3
• Targeted contract: 0x6e90c85a495d54c6d7e1f3400fef1f6e59f86bd6
• Deployment transaction for the targeted contract, created hours before the exploit: 0x852eca15a9fd352817346915f7bc8817d46de349bd7a8fc6ee73c7b66ec9ab41

Per QuillAudits' reconstruction, the attack flow was: flash-loan 4,000 USDC from Morpho, swap it for crvUSD on Curve, execute the donation to break the exchange-rate math, borrow 10 million reUSD against worthless collateral, convert the proceeds back to ETH, and repay the flash loan — pocketing the rest.

Response and compensation

Resupply's initial public statement framed the damage as contained to the wstUSR market, stating the protocol "continues to function as intended," and promised a full post-mortem once analysis was complete.

Curve founder Michael Egorov moved to distance the Curve project from the incident, stating no one from Curve worked on Resupply and asking that the two not be conflated.

On the compensation side, Resupply's insurance fund began covering losses, and Convex contributor C2tP personally contributed $1.4 million toward user losses, followed by an additional $810,000 from Convex. Combined with roughly $600,000 in initial treasury payments, total repayments toward the $9.5 million loss exceeded $2.8 million.

C2tP's personal contribution drew praise from the community, with commenters framing it as characteristic of him, while noting that LP funds themselves had remained safe throughout. The episode also underscored that, absent such individual gestures, protocol failures leave users largely unprotected.

The insurance pool itself became a point of contention: many participants said they had joined without fully understanding its terms, with one community member noting that the pool was in fact designed to cover bad debt — a mechanism not everyone realized they had signed up for.

The audit question

Resupply had undergone security reviews from ChainSecurity and yAudit, now Electi, roughly three to four months prior to the hack. Both firms initially stated that the exploited market fell outside their audit scope, having been deployed after their reviews concluded.

Following Resupply's own post-mortem, a three-way discussion between Rekt News, the audit firms, and the Resupply team produced a more nuanced picture: the vulnerable code pattern itself had in fact been reviewed. ChainSecurity clarified that the vault code deployed later was in scope, but that deployment and secure initialization of those vaults was not — its audit had assumed "meaningful collateral" would exist at deployment, an assumption the actual launch violated.

Electi said it was "in the same boat," confirming that while the deployment process wasn't in scope, the underlying price-calculation rounding-to-zero issue was covered by its review.

ChainSecurity noted more broadly that validating deployments isn't yet standard audit practice — a gap that becomes a blind spot whenever a protocol initializes a market differently than the audited code anticipated. Both firms had reviewed code that functioned correctly as designed; it was the zero-collateral deployment conditions that created the actual exploit path.

Summary

A market deployed with no meaningful collateral, a documented ERC4626 donation attack pattern, and a rounding-to-zero bug in the exchange-rate formula combined to let an attacker turn a few thousand dollars of borrowed capital into a $9.8 million loan within about two hours of the market's launch. Passed governance votes and completed audits did not prevent the exploit, and the subsequent dialogue between Resupply and its auditors highlighted an unresolved question in DeFi security practice: whether responsibility for validating a live deployment's initial conditions belongs to the auditor, the protocol team, or somewhere in between.