Cowrie Research

venus-zksync-wusdm-donation-exchange-rate-exploit-2025-02-27

14 min read

Venus ZKsync wUSDM Donation Exchange-Rate Exploit (2025-02-27)

  • Name: Venus ZKsync wUSDM donation exchange-rate exploit
  • Date: 2025-02-27
  • Protocol: Venus Protocol
  • Chain: ZKsync Era
  • Category: donation / share-price manipulation / ERC-4626 exchange-rate inflation / self-liquidation bad-debt exploit
  • Loss: about 716,000 net after roughly $185,000 recovery
  • Summary: After zkSync-native wUSDM supply had already shrunk from about 5.33M to 1.27M, the attacker used a 2,100 WETH flash loan to build a two-account position on Venus: one account borrowed large amounts of wUSDM against WETH, while the other kept re-supplying that borrowed wUSDM as collateral. The attacker then redeemed 411,021.57 wUSDM into 439,560.48 USDM, donated that USDM directly into Mountain Protocol’s zkSync wUSDM wrapper, and pushed the local wUSDM exchange rate from about 1.0694 to 1.76413937. That donation made the first Venus account liquidatable, let the second account seize WETH collateral at the manipulated rate, and left Venus with bad debt once the flash loan was repaid.
  • Trigger / entry point:
    • Venus listed zkSync wUSDM as a lending-market asset even though the token’s price path depended on the wrapper’s own convertToAssets / exchange-rate state rather than on a chain-agnostic hard peg.
    • On zkSync, Mountain’s wrapped token kept a chain-local exchange rate. When users redeemed a large amount of wUSDM on 2025-02-24, total supply fell from about 5.33M to 1.27M, making later direct donations much more price-sensitive.
    • Venus treated the resulting wUSDM exchange rate as solvency-relevant collateral truth without a cap, delay, or other correlated-asset guardrail.
    • The market design also let the attacker use wUSDM as both the borrowed asset on one account and the supplied collateral on another, which made post-inflation self-liquidation profitable.
  • Root cause:
    • Mountain’s zkSync wUSDM implementation allowed direct USDM donations to increase assets-per-share without minting new shares, so convertToAssets could be inflated on that chain alone.
    • Venus relied on that ERC-4626 exchange rate as if it were a trustworthy price feed for lending-market solvency.
    • Because wUSDM remained borrowable and collateral-eligible during the manipulation window, the attacker could turn the inflated exchange rate into both liquidation proceeds and additional borrow power.
    • In short: a non-empty but thinned ERC-4626 wrapper became a printable price source, and Venus honored that printed price quickly enough for the attacker to cash it out.
  • Exploit path:
    1. Three days before the exploit, a redeem transaction on zkSync (0xd97d91eb39bfa03d3c38636022c75d4fadb4a1d5702c827453fd3dac8a1727d8) cut wUSDM supply on that chain from about 5.33M to 1.27M, making the wrapper materially easier to move with a direct donation.
    2. In the main exploit transaction (0x35a0172fb6bd450ceb29aa67dc85221826dfd0b7528375400b4ccf15c1eed0d8), the attacker address 0x16be708e257a0df0f4275ecd9b0f70ce4b45430c took a 2,100 WETH flash loan from Aave.
    3. The attacker deposited that WETH into Venus and began looping through two wallets: one wallet borrowed wUSDM, transferred it to the second wallet, and the second wallet re-supplied that wUSDM into Venus as collateral.
    4. Repeating that loop built a position with about 2,167,431 wUSDM of debt and supplied wUSDM, then an additional 411,021 wUSDM borrow remained on the first wallet.
    5. The attacker redeemed 411,021.57 wUSDM for 439,560.48 USDM at the pre-attack exchange rate of about 1.0694.
    6. They then transferred the 439,560.48 USDM directly into the zkSync wUSDM wrapper contract 0xa900cbe7739c96d2b153a273953620a701d5442b, inflating the local exchange rate to about 1.76413937 without minting offsetting new wUSDM shares.
    7. That donation pushed the first Venus wallet underwater. The second wallet withdrew 1,882,000 wUSDM, used it to liquidate the first wallet, and seized about 1,493.05 vWETH, while Venus Treasury accrued about 71.34 WETH in liquidation fees.
    8. The attacker then withdrew about 1,498.08 WETH from the seized vWETH, borrowed an additional 162.13 WETH against the second wallet’s still-inflated wUSDM collateral, repaid the 2,101.05 ETH flash loan, and kept about 86.72 WETH plus 55,000 wUSDM.
  • What the attacker needed to be true:
    • zkSync wUSDM supply had to be low enough that a roughly 439.6K USDM donation could move assets-per-share dramatically.
    • Direct donations into the wrapper had to change convertToAssets immediately, without minting additional wUSDM.
    • Venus had to trust the wrapper exchange rate as borrow and collateral truth without a CAPO-style rate limiter, pause trigger, or discount.
    • The protocol had to let one account supply inflated wUSDM while another related account became liquidatable against that same inflation event.
    • There needed to be enough WETH liquidity inside Venus for self-liquidation and post-liquidation borrowing to turn the printed exchange rate into withdrawable value.
  • Technical anatomy worth remembering:
    • This was not the pure empty vault + 1 wei variant seen in some ERC-4626 exploits. About 1.27M shares still existed on zkSync, but the supply had become thin enough that a six-figure donation could still move the exchange rate by roughly 65%.
    • The chain-local implementation detail mattered. wUSDM stayed near its normal rate on Ethereum, Arbitrum, and Optimism, while zkSync’s local wrapper state diverged sharply.
    • The attacker did not just inflate collateral and borrow once. The decisive monetization step was to split the position across two Venus accounts so the manipulated exchange rate made one account liquidatable and the other account the profitable liquidator.
    • Venus is also the correlated-capital cousin in liquidation-capital-provenance-and-keeper-competition-assumptions: the wrapper family that printed the collateral mark was effectively the same family underwriting liquidation ammunition, so the protocol never had genuinely independent capital proving the inflated rate was executable.
    • The donation also spilled into adjacent markets: once the wrapper rate jumped, arbitrageurs bought underpriced wUSDM from SyncSwap and redeemed it at the inflated wrapper rate, draining value from LPs outside Venus itself.
  • Representative transactions and addresses:
    • Attacker EOA: 0x16be708e257a0df0f4275ecd9b0f70ce4b45430c
    • Precondition redeem tx that thinned zkSync supply: 0xd97d91eb39bfa03d3c38636022c75d4fadb4a1d5702c827453fd3dac8a1727d8
    • Main exploit tx: 0x35a0172fb6bd450ceb29aa67dc85221826dfd0b7528375400b4ccf15c1eed0d8
    • Venus market pause tx: 0x309a2b3e03e36c116aca7f295501e82ef18f5310c7d730c3e067fb03507bcab9
    • Mountain manual rate-reset tx: 0x616a5445ac3c501f0f2ee3833866fbae497d1392d810eb980934d1a0512844a7
    • Venus risk-parameter change tx (CF = 0, RF = 100%): 0x2ea99b2247cae538f7c4fa1d9026bed2ef1b118342853a422f377edbf31bf0d2
    • zkSync wUSDM wrapper: 0xa900cbe7739c96d2b153a273953620a701d5442b
  • Response / mitigation:
    • Venus paused the zkSync wUSDM market on the same day, then set collateral factor to 0 and reserve factor to 100% to stop new risk from building.
    • Mountain manually pushed the exchange rate back toward normal by burning 8,203 USDM in the wrapper contract.
    • Venus later reported that initial bad debt of about $902K had been reduced by about $185K of recovery, leaving about $716K net protocol cost.
    • The incident became a public case study for why ERC-4626 assets need integration-specific controls such as correlated-asset caps, kill switches, or other rate-limiting logic before they are admitted as lending collateral or borrowable base assets.

Why this incident matters

  • Venus preserves a mechanically distinct cousin inside the donation / share-price family: not an empty-vault launch bug like Resupply, not a rounding-heavy stealth-donation loop like Wise, and not a non-empty wrapper oracle like Lodestar, but a chain-local wrapped stablecoin whose exchange rate could be printed through direct donation after supply on one chain thinned out.
  • It also shows that ERC-4626 integration risk is not confined to the collateral side. Here the same manipulated asset sat on both sides of Venus’s balance sheet and the attacker monetized the distortion through self-liquidation.
  • The preserved healthy boundary was not merely price the wrapper better, but a chain-local wrapper rate becoming readable is still not the same thing as that rate becoming immediate collateral truth, borrowable base-asset truth, and liquidation truth in the same market family.
  • The case is a strong reminder that cross-chain wrappers can inherit new exploit surfaces even when the economic story of the underlying asset looks conservative and treasury-backed.

Three wrapper-solvency promotions this incident collapsed

  1. zkSync wUSDM’s local backing and exchange rate changed

    • Earlier redemptions had already reduced zkSync wUSDM supply to about 1.27M, and the attacker’s direct 439,560.48 USDM donation into Mountain’s wrapper then pushed the local exchange rate from about 1.0694 to 1.76413937.
    • That only proved the chain-local wrapper state had moved. It did not yet mean the new rate deserved to become immediate lending-solvency truth for Venus.

  2. Venus treated that chain-local wrapper mark as canonical lending truth

    • Venus accepted the zkSync wrapper’s convertToAssets-style exchange rate as if it were already strong enough to define collateral value, debt-side risk, and liquidation eligibility inside the market.
    • This was the decisive false promotion: a deployment-local, donation-authorable wrapper mark stopped being just Mountain's local accounting state and became Venus's canonical solvency answer.

  3. The same market family spent against that published truth through liquidation and further borrowing

    • Once the first account became liquidatable, the second account could withdraw wUSDM, liquidate the first account, seize WETH, then borrow additional WETH while the inflated wrapper mark still stood.
    • This is where a printable wrapper rate became realized reserve loss. The bad mark did not merely sit in collateral accounting; it immediately inherited live liquidation and withdrawal authority against stronger assets.

Pattern tags:

  • Direct donation / share-price manipulation against a chain-local ERC-4626 wrapper whose local convertToAssets state became lending-market truth.
  • Supply-thinning replay: the exploitable condition was not brand-new vault, but recent chain-local redemptions had pushed live wrapper supply low enough that a six-figure donation could still reprice the remaining shares violently.
  • Same-family balance-sheet reuse: the manipulated wrapper sat on both the borrow side and the collateral side, so the printed rate did not just expand borrow power — it also funded the liquidation path.
  • Design companions: vault-share-truth-security-object, collateral-admission-lag-and-borrow-side-quarantine, and recursive-borrow-suppression-for-fresh-collateral.

Why the exploit worked

  • Mountain’s zkSync wUSDM wrapper let direct USDM donations increase assets-per-share immediately, so the exchange rate was locally canonical but still attacker-authorable on that chain.
  • Earlier redemptions had already thinned live zkSync supply, which meant a donation large enough to be practical for a flash-loan attacker could still move the wrapper rate by roughly two-thirds.
  • Venus treated that wrapper-local rate as one joined solvency object: collateral value, borrow-side authority, and liquidation eligibility all updated fast enough to honor the manipulated mark before any chain-local distrust boundary narrowed it.
  • The protocol also left the recursive and liquidation graph too open: one account could become insolvent under the printed mark while a related account still held the right collateral and borrow permissions needed to seize WETH and finish the cash-out.

Detection and audit pivots

  • Re-run wrapper-collateral reviews after large redemptions, bridge migrations, or chain-local supply shifts; non-empty ERC-4626 wrappers can quietly become donation-sensitive again long after listing.
  • Ask whether a listed wrapper can be both borrowed and posted as collateral in closely related accounts or routes. If so, model self-liquidation and puppet-account closeout explicitly rather than assuming liquidator independence.
  • Check whether chain-local wrapper implementations inherit the same semantics as the canonical deployment. Cross-chain same ticker assets can carry different donation sensitivity, supply profile, and emergency controls; review them as separate solvency objects rather than as one branded family.
  • Separate wrapper rate is readable from wrapper rate may immediately drive borrow power and liquidation. If one sudden convertToAssets jump can move both at once, the market still lacks a real distrust boundary.
  • Trace the post-manipulation unwind outside the lending market too. If adjacent AMMs or redemption venues let arbitrageurs cash the same printed wrapper mark, protocol-local loss can understate the real ecosystem blast radius.

Failure-prevention checklist

  • Treat chain-local ERC-4626 wrappers as distinct solvency objects even when they share a ticker and issuer with safer deployments on other chains. If convertToAssets can diverge by chain, collateral policy, borrowability, and kill switches should diverge by chain too.
  • Re-underwrite wrapper listings after large supply contractions. A wrapper that was safe enough at 5.33M live supply may no longer deserve the same caps, collateral factor, or borrow permissions after redemptions shrink it toward 1.27M.
  • Do not let a donation-sensitive wrapper sit on both sides of the balance sheet without extra controls. If the same asset can be borrowed, posted as collateral, and then used to fund liquidation, the protocol should assume self-liquidation is part of the threat model.
  • Add delayed-recognition, haircut, or quarantine logic for abnormal wrapper-rate jumps. A one-transaction convertToAssets move should not become immediate collateral authority, borrow authority, and liquidation authority at once.
  • Constrain recursive same-family leverage. If one account can borrow a wrapper while a second account re-supplies it, the protocol should either suppress that graph entirely or keep strict caps that still hold under donation-driven repricing.
  • Keep an operational downgrade path that is specific to wrapper semantics: pause the market, set collateral factor to zero, raise reserve factor, revoke borrowability, and if necessary de-recognize the wrapper until the exchange-rate path is trustworthy again.
  • Monitor wrapper supply floors, redemption bursts, and cross-venue liquidity together. If redemption depth, AMM depth, and lending exposure can all be destabilized by the same chain-local supply thinning, that is already one joined risk object.

Audit prompts

  • If the wrapper’s live supply falls 50% to 80% in one redemption wave, what governance or automated review resets its collateral assumptions before the next block of lending activity?
  • Can this asset still be borrowed, re-supplied, and used as liquidation ammunition by closely related accounts after its exchange rate becomes donation-sensitive?
  • What exact mechanism stops a sudden convertToAssets jump from changing all three surfaces at once: borrowing power, liquidation eligibility, and post-liquidation collateral withdrawal?
  • Are chain-local wrapper implementations reviewed as separate assets with separate incident runbooks, or does the protocol inherit one shared same token, same risk story from the issuer brand?
  • If a wrapper market is paused, what residual paths still monetize the printed rate — existing collateral, liquidations in flight, redeemability, AMM arbitrage, or sibling-market borrow positions?
  • How much real capital is needed to move the chain-local wrapper rate after recent redemptions, and does that amount stay comfortably above what a flash-loan attacker can source?
  • If the protocol expects liquidations to protect it, where is liquidator independence enforced once the same wrapper family is also the source of borrow-side leverage and collateral value?

Lessons that should already be standard

  • Cross-chain sameness of branding is not cross-chain sameness of risk. A wrapper that looks treasury-backed and conservative on one chain can still become locally printable on another.
  • Supply thinning is a live production state, not just launch trivia. Large redemptions can quietly turn a seasoned wrapper into a donation-sensitive collateral object.
  • A wrapper rate can be honest, locally canonical, and still unsafe to lend against immediately. convertToAssets truth is weaker than lending-solvency truth.
  • Borrow-side and collateral-side admission should be reviewed together. Letting the same donation-sensitive wrapper serve as debt, collateral, and liquidation funding is an avoidable design amplification.
  • Liquidation is not an independent safety valve if the attacker can author the insolvency, warehouse the collateral, and fund the closeout from the same market family.
  • Emergency controls need to match wrapper semantics. Pausing after the fact helped Venus limit damage, but healthy design would have assumed in advance that a chain-local wrapper mark might need haircut, quarantine, or full de-recognition before governance can debate the theory.

Internal linkages

Control surface

Graph View

Backlinks