Loss: the attacker extracted about 53.2 WBTC plus about 99,976 USDT (roughly $1.2M at the time), while Inverse’s own incident summary and later bad-debt reporting framed the protocol damage as materially larger because the Frontier / Anchor DOLA market was left with multi-million-dollar shortfall.
Summary: Inverse’s Frontier money market let Yearn yvCurve-3Crypto vault shares back DOLA borrowing, but the collateral oracle ultimately trusted live Curve 3Crypto pool state closely enough that one flash-loan-funded WBTC→USDT swing could make the LP wrapper look far richer than it really was. In exploit transaction 0x958236266991bc3fe3b77feaacea120f172c0708ad01c7a715b255f218f9313c, the attacker borrowed 27,000 WBTC from Aave, turned 225 WBTC into about 5,375 crv3Crypto, deposited those LP tokens into Yearn for about 4,906 yvCurve-3Crypto, then used the remaining 26,775 WBTC to shove Curve 3Crypto balances far enough out of line that the collateral oracle reportedly jumped from about 979 to 2,831. Anchor then let the attacker borrow 10,133,949 DOLA against that inflated LP mark. After reversing the pool distortion and repaying the flash loan, the attacker kept the spread while the protocol absorbed bad debt.
Trigger / entry point:
Inverse’s Frontier / Anchor market accepted yvCurve-3Crypto as collateral for DOLA borrowing.
Inverse’s collateral path reached borrowAllowed() → getHypotheticalAccountLiquidityInternal() → getUnderlyingPrice() and then consumed an oracle answer derived from manipulable pool state.
The attacker could both manipulate the underlying Curve 3Crypto balances and exercise the borrow path in the same transaction.
Root cause:
Inverse treated a Yearn-wrapped Curve LP token as if a spot reserve read were a durable solvency mark rather than a flash-loan-printable state snapshot.
The protocol effectively priced collateral from current Curve composition without enough delay, liquidity haircut, or realizability discipline.
The dangerous step was not merely oracle uses Curve; it was manipulable LP NAV becomes immediate borrow power against a different balance sheet.
Exploit path:
The attacker funded EOA 0x7b792e49f640676b3706d666075e903b3a4deec6 from Tornado Cash and executed the exploit through contract 0xf508c58ce37ce40a40997c715075172691f92e2d.
In transaction 0x958236266991bc3fe3b77feaacea120f172c0708ad01c7a715b255f218f9313c, the attacker flash-borrowed 27,000 WBTC from Aave.
They deposited 225 WBTC into Curve 3Crypto, minting about 5,375 crv3Crypto, then deposited those LP tokens into Yearn and received about 4,906 yvCurve-3Crypto.
The attacker posted that yvCurve-3Crypto position to Anchor as collateral.
With the remaining 26,775 WBTC, they executed a huge swap into about 75,403,376 USDT on Curve 3Crypto, sharply distorting the pool balances and, according to BlockSec’s analysis, lifting the collateral oracle input from about 979 to about 2,831.
While that manipulated state was still live, the attacker borrowed 10,133,949 DOLA from Anchor.
They then reversed the large Curve trade, swapping the 75,403,376 USDT back into about 26,626.49 WBTC, and converted the borrowed DOLA into 3Crv and then USDT to finish rebuilding flash-loan repayment capital.
After swapping 10,000,000 USDT back into WBTC and repaying Aave, the attacker withdrew the residual profit: about 99,976 USDT plus about 53.2 WBTC.
What the attacker needed to be true:
yvCurve-3Crypto had to be accepted as ordinary borrowable collateral rather than quarantined or deeply haircut.
The collateral oracle had to depend closely enough on live Curve 3Crypto balances that one transaction could print a much richer LP mark.
The borrow path had to honor that manipulated mark immediately, without a delayed snapshot or depth-aware sanity check.
Anchor had to lend a more money-good asset (DOLA) against the printed LP collateral value.
Technical anatomy worth remembering:
This is the LP wrapper is only as honest as the pool state underneath it lesson, not a generic flash loans are dangerous story.
The attacker did not need to steal collateral from Yearn or Curve directly. They only needed Inverse to over-believe what one yvCurve-3Crypto share was worth for a few instructions.
The important structural mismatch was temporary mark-to-spot LP NAV versus permanent lending-market debt issuance.
It is also a good contrast with Inverse’s April 2022 INV incident: April printed the price of a thin governance token directly, while June printed the price of a more complex LP wrapper by distorting the pool balances feeding its oracle.
Representative withdrawal of 53 WBTC: 0x9959f8f10f59b3b88a5499066a21237e492f193e5ff2950bcc7e6c1f5e1fa60c
Representative withdrawal of 100k USDT: 0x3d2f86c1c289731f56bed95dce20434eff48e3bd4a50cdc007ef5d0a2177a9f7
Response / mitigation:
Inverse publicly announced the incident the same day and emphasized that no user funds were taken from wallets or directly at risk outside the manipulated borrowing market.
Contemporaneous reporting said the protocol paused or removed the affected Frontier / Anchor borrowing activity while assessing damage.
The protocol’s later public framing and RiskDAO bad-debt tracking made the key aftermath clear: even when attacker take-home was only about $1.2M, the real balance-sheet damage was the much larger DOLA-market shortfall left behind.
The longer-run lesson was not just swap oracle vendors; it was that LP-wrapper collateral needed stronger admission discipline, slower oracle trust, and tighter bad-debt containment.
Three LP-wrapper-and-borrow-authority promotions this incident collapsed
1. A Curve-shaped reserve print could still exist under the wrapper
Once the attacker shoved 26,775 WBTC through Curve 3Crypto, the underlying pool could already publish a much richer reserve picture for the crv3Crypto position sitting inside Yearn’s yvCurve-3Crypto wrapper.
BlockSec’s reconstruction preserved the local distortion clearly enough: the collateral oracle input reportedly jumped from about 979 to about 2,831 while the manipulated Curve state was live.
At that stage the protocol had only learned the wrapped LP can be described by a far richer same-transaction pool state right now; it had not yet proven that this state deserved lending-scale meaning.
2. Inverse still promoted that pool print into canonical collateral truth
The decisive promotion was that Anchor’s collateral path did not keep the distorted Curve state as merely observable wrapper-local information. borrowAllowed()→getHypotheticalAccountLiquidityInternal()→getUnderlyingPrice() still promoted it into the official solvency answer for yvCurve-3Crypto collateral.
That is where the exploit stopped being merely Curve moved a lot. Inverse crossed from a manipulable reserve vector exists under the wrapper to that reserve vector still counts as money-good collateral truth for this Yearn receipt token.
The wrapper layer mattered because it made the asset look one abstraction step safer. The exploit preserved the opposite lesson: the protocol still inherited the underlying pool’s timing and realizability risk as soon as it blessed the wrapper’s reserve-derived mark as canonical borrowable value.
3. That published collateral truth still inherited immediate DOLA issuance authority
The final promotion was that the manipulated wrapper mark did not merely affect monitoring or UI state; it still let the attacker borrow 10,133,949 DOLA in the same transaction before the Curve distortion unwound.
Anchor therefore honored a paper LP-wrapper NAV as if it were durable balance-sheet backing for a much stronger liability. Once the attacker reversed the pool skew, the printed collateral truth disappeared but the issued DOLA debt remained.
That is the reusable design split worth preserving: a reserve-shaped wrapper mark exists, that mark becomes canonical collateral truth, and that accepted truth still deserves immediate borrow authority against the protocol's DOLA balance sheet were three different promotions, and Inverse collapsed them into one flash-loan bundle.
The decisive preserved shape is wrapped LP looked diversified, but the money-good collateral truth still collapsed to one same-transaction Curve 3Crypto reserve print.
This is also a clean borrow-side quarantine failed even if the local wrapper price path seemed explainable case: Inverse did not need a fully nonsensical number, only a flash-loan-authored number that Anchor was willing to honor immediately.
Why the exploit worked
Inverse let a Yearn wrapper flatten away the real collateral question. yvCurve-3Crypto looked like a higher-level vault receipt, but the money-good truth still reduced to what would Curve 3Crypto reserves imply right now if one borrower printed them with a flash loan?
The oracle path had no meaningful delay between manipulated pool state exists and that state becomes DOLA borrow power. The attacker could distort Curve 3Crypto, keep the distorted state live long enough for getUnderlyingPrice() to consume it, and borrow before unwind pressure restored reality.
The protocol over-credited paper NAV instead of executable unwind value. A temporary reserve vector that could not support a real protocol-scale unwind still got treated as if it were durable collateral backing for over 10M DOLA of debt.
Borrow-side trust was too binary. There was no visible intermediate state where yvCurve-3Crypto could remain observable or partially admitted while same-window reserve-shaped marks were prevented from underwriting full-size DOLA issuance.
The balance-sheet damage outran the attacker’s direct extraction because the real failure was not attacker stole exactly what they cashed out; it was Anchor issued debt against collateral truth that disappeared as soon as the manipulation ended.
Detection and audit pivots
Trace the exact valuation chain all the way down: yvCurve-3Crypto receipt → Yearn vault share semantics → Curve 3Crypto LP reserves → the specific oracle read consumed by getUnderlyingPrice(). If the bottom of that chain is same-window pool state, the wrapper layer has not actually removed manipulability.
Ask whether the protocol is valuing the LP / wrapper at infinitesimal spot NAV or at executable unwind value under stressed size. If a borrower can print a reserve vector that cannot survive liquidation-scale exit, the collateral path is already over-trusting paper value.
Rehearse the exploit as one joined transaction, not as separate oracle and lending reviews: flash-loan funding, LP mint, wrapper deposit, reserve distortion, collateral check, borrow, unwind, and flash-loan repayment should be simulated together.
Review whether a fresh or sharply moved LP-wrapper mark can be read without being immediately borrowable. If observation, collateral admission, and borrowing all happen in one state transition, the distrust boundary is missing.
Compare attacker take-home with protocol bad debt. If the protocol can lose far more than the attacker directly pockets, reviewers should treat that gap as evidence that paper collateral truth is being honored far beyond realizable exit depth.
Failure-prevention checklist
Haircut wrapped LP collateral to weakest-leg executable unwind value, not to instantaneous pool-reserve marks or wrapper-local NAV that only hold while the attacker keeps the pool distorted.
Separate oracle can read the mark from borrower can mint debt against the mark. Fresh or sharply moving LP-wrapper prices should begin behind collateral-factor 0, isolated mode, or tightly capped debt until they survive hostile timing.
Refuse same-transaction reserve-state publication into borrowing authority when the borrower can also author the underlying pool state with flash liquidity.
Treat Yearn / ERC-4626 / vault wrappers around LP tokens as inherited pool-risk surfaces, not as automatic safety upgrades. The wrapper is only as safe as the underlying pool state the oracle ultimately trusts.
Size debt ceilings and borrow caps against realistic liquidation and unwind depth of the underlying LP, not just against nominal wrapper TVL or a reputable brand name on the vault.
Put LP-wrapper collateral behind asset-local rollback controls: pause new borrows, cut collateral factor, or isolate the market faster than bots can recycle a manipulated mark into bad debt.
Test complete exploit loops with realistic flash-loan sizes and same-block timing instead of only validating that the oracle math looks sensible in steady state.
Audit prompts
What exact underlying pool state does this wrapper collateral reduce to at the final oracle read, and can the borrower shape that state inside the same transaction as the borrow?
If the protocol had to liquidate this LP-wrapper position at the borrowed size immediately after the mark was consumed, what value could it actually realize once the manipulated reserves normalized?
Can the asset stay observable while borrowing remains capped or disabled, or does the protocol still collapse observation, collateral admission, and debt issuance into one step?
Which component is really the weakest leg here: the wrapper exchange-rate logic, the child LP token, the underlying pool reserves, or the liquidation venue depth?
What exact control stops a flash-loan-authored reserve print from becoming same-block debt authority: TWAP, delayed snapshots, borrow-side quarantine, unwind haircut, or nothing?
If this mark doubled for one block and then reverted, how much bad debt could the protocol create before any human or automated control could intervene?
Does governance treat listing a wrapped LP as collateral and choosing the final reserve-derived pricing path as one joined solvency decision, or are those still fragmented approvals that can each look reasonable in isolation?
Lessons that should already be standard
A wrapper around an LP token does not erase the LP’s weakest-leg oracle problem. It only moves the dangerous read one abstraction layer deeper.
Same-transaction readability is price authorship. If the borrower can print the reserve state and immediately consume it, the protocol is effectively letting users write collateral truth.
Spot NAV is not liquidation truth. If the protocol cannot actually exit the collateral at the honored size after manipulation ends, it should not lend against that mark as if it were money-good.
Borrow-side quarantine matters even when the local oracle path looks explainable. A coherent-looking wrapper price can still be too fresh, too thin, or too attacker-authored to deserve immediate debt authority.
Protocol bad debt can be the real loss even when attacker take-home looks smaller. Lending systems fail when they issue strong liabilities against collateral value that disappears on contact with unwind reality.
Reputable wrapper + reputable pool is not a defense if one flash-loan-sized trade can still decide what the wrapper means for one block.
Why this incident matters
It is a clean example of LP-token oracle mispricing where the attacker does not post a thin memecoin LP, but a respectable-looking Yearn wrapper whose value still collapses to manipulable pool balances.
It shows how a protocol can inherit reserve-manipulation risk one abstraction layer higher than the pool itself.
It is also a strong negative exemplar for LP collateral weakest-leg unwind and same-window quarantine: the wrapper layer made the collateral look operationally cleaner, but the real unwind truth still depended on Curve 3Crypto state that the attacker could print and consume before it aged into trustworthy debt authority.
It also helps separate two different oracle-manipulation families inside the same protocol history: thin-governance-token collateral inflation in April 2022 versus wrapped-LP collateral inflation in June 2022.
Positive-design companion: lp-collateral-weakest-leg-unwind-and-same-window-quarantine — use this when the sharper follow-up is how a lending market should treat a wrapped LP as only as credible as the weakest executable exit path underneath it, rather than as a safer abstraction layer.
Timing-side design companion: delayed-snapshots-and-same-block-quarantine — use this when the sharper follow-up is why a flash-loan-distorted Curve 3Crypto mark should not have become immediate DOLA borrow power in the same transaction.
The leverage sat in LP-collateral admission, the yvCurve-3Crypto pricing path, same-transaction borrowability, and the willingness to let a reserve-derived wrapper mark define immediate DOLA solvency.
Inverse did not only have an oracle bug; it let a transient Curve reserve configuration become money-good collateral truth for a lending market.