Cowrie Research

nereus-finance-wavax-usdc-joe-lp-exchange-rate-manipulation-undercollateralized-nxusd-borrow-2022-09-06

15 min read

Nereus Finance WAVAX-USDC Joe LP exchange-rate manipulation / undercollateralized NXUSD borrow (2022-09-06)

  • Name: Nereus Finance WAVAX-USDC Joe LP exchange-rate manipulation / undercollateralized NXUSD borrow
  • Date: 2022-09-06
  • Protocol: Nereus Finance
  • Chain: Avalanche
  • Category: oracle manipulation / LP-token collateral inflation / same-transaction oracle refresh / undercollateralized borrow
  • Loss: about 500K` of manipulated Joe LP collateral
  • Summary: The attacker flash-borrowed 51M USDC from Aave on Avalanche, used Trader Joe’s WAVAX-USDC pair to mint a tiny amount of JLP collateral, then spent the remaining flash liquidity to shove the same pair’s reserves far off normal. Nereus’s NXUSD borrowing market accepted that WAVAX-USDC Joe LP token as collateral through a CauldronV2 market whose updateExchangeRate() path read a reserve-derived oracle value from the manipulated pool. After calling that update while the pool was distorted, the attacker posted about 0.04533 JLP, borrowed about 998K NXUSD from DegenBox, unwound the WAVAX price distortion, swapped the NXUSD route back toward USDC, repaid the flash loan, and kept about $370K.
  • Trigger / entry point:
    • The affected market was the Nereus AVAX/USDC Joe LP NXUSD borrowing market built with a CauldronV2-style market contract at 0xC0A7a7F141b6A5Bce3EC1B81823c8AFA456B6930, backed by DegenBox 0x0B1F9C2211F77Ec3Fa2719671c5646cf6e59B775.
    • The market accepted Trader Joe’s WAVAX-USDC pair token 0xf4003F4efBE8691B60249E6afbD307aBE7758adb as collateral.
    • The attacker could call updateExchangeRate() during the same transaction after manipulating the underlying Joe pair reserves.
    • Once the manipulated exchange rate was published, the ordinary borrow path treated the small JLP position as sufficient collateral to withdraw roughly 998K NXUSD.
  • Root cause:
    • Nereus let a reserve-based oracle for the WAVAX-USDC Joe LP token define live borrowing power for an NXUSD lending market.
    • The exchange-rate update was externally callable in the same transaction window as the reserve manipulation, so flash-loan-sized pool distortion could become immediate solvency truth.
    • The protocol therefore treated a tiny LP position as if it were durable, realizable collateral even though the quoted value only existed while the attacker was temporarily stuffing the underlying Trader Joe pair with flash-loaned USDC and WAVAX.
    • This was not merely flash loans are dangerous; it was a balance-sheet design failure where a shallow, attacker-shaped LP mark controlled how much protocol credit DegenBox would release.
  • Exploit path:
    1. The attacker contract 0x16b9A828E8F37bC8f7640E962B805e31A4497b29 executed exploit transaction 0x0ab12913f9232b27b0664cd2d50e482ad6aa896aeb811b53081712f42d54c026 and flash-borrowed 51M USDC from Avalanche Aave.
    2. It swapped about 280K USDC for WAVAX on Trader Joe, then added about 260K USDC plus the acquired WAVAX as liquidity to the WAVAX-USDC Joe pair, minting about 0.04533 JLP.
    3. It then spent the remaining 50.46M USDC in the same Trader Joe pool to buy WAVAX, radically changing the WAVAX/USDC reserve composition that Nereus’s LP oracle relied on.
    4. With that manipulated reserve state still live, the attacker deposited the JLP into DegenBox, added it as collateral to the Cauldron market, and called updateExchangeRate().
    5. Faraz’s reconstruction showed the market exchange rate moved from about 88793190826 to about 32701350550, which sharply increased the amount of NXUSD the same LP position could support.
    6. The attacker then borrowed about 998K NXUSD and withdrew it from DegenBox.
    7. Next the attacker swapped the temporarily pumped WAVAX back to USDC, restoring the Trader Joe pool closer to normal while keeping the borrowed NXUSD.
    8. The attacker routed NXUSD through the NXUSD-3CRV Curve metapool and then through USDC.e/USDC conversion paths to end up back in USDC.
    9. After repaying the 51M USDC flash loan plus fee, roughly $370K USDC remained as profit.
  • What the attacker needed to be true:
    • Nereus had to accept the WAVAX-USDC Joe LP token as collateral without a haircut matched to the real executable depth of that pool.
    • The oracle path had to value that LP token from live reserve state rather than from a delayed or manipulation-resistant mark.
    • The attacker had to be able to force the market to consume the manipulated exchange rate before the pool normalized.
    • The protocol’s payout asset, NXUSD, had to be liquid enough that borrowed tokens could be routed back into stronger dollar liquidity before the transaction ended.
  • Technical anatomy worth remembering:
    • This is a clean LP-collateral valuation exploit, not a generic stablecoin depeg story. The decisive lie was the solvency mark on the Trader Joe LP token.
    • The capital sequence mattered: first mint a tiny amount of LP collateral, then distort the same underlying pool, then call updateExchangeRate(), then borrow against the freshly inflated collateral mark.
    • CertiK described the affected path as a CauldronV2 exchange-rate manipulation, while Faraz’s reconstruction shows the exploit was economically about reserve-derived WAVAX-USDC Joe LP pricing rather than about a bug in DegenBox bookkeeping.
    • The borrowed asset was weaker than blue-chip stablecoins — NXUSD rather than native USDC — but that did not save the protocol because Curve and Trader Joe still let the attacker route the minted credit back into repayable USDC inside one transaction.
    • This is a useful middle case between Cheese Bank and Warp on one side and Inverse Anchor on the other: the collateral object was a plain AMM LP token, but the payout asset was the protocol’s own stablecoin rather than pooled lender stablecoins.
  • Representative transactions and addresses:
    • Main exploit transaction: 0x0ab12913f9232b27b0664cd2d50e482ad6aa896aeb811b53081712f42d54c026
    • Attacker contract: 0x16b9A828E8F37bC8f7640E962B805e31A4497b29
    • Profit recipient noted by CertiK: 0x8ec7...
    • Flash-loan source (Aave Pool): 0x794a61358D6845594F94dc1DB02A252b5b4814aD
    • Trader Joe Router: 0x60aE616a2155Ee3d9A68541Ba4544862310933d4
    • WAVAX-USDC Joe LP collateral token: 0xf4003F4efBE8691B60249E6afbD307aBE7758adb
    • DegenBox: 0x0B1F9C2211F77Ec3Fa2719671c5646cf6e59B775
    • Exploited Cauldron market: 0xC0A7a7F141b6A5Bce3EC1B81823c8AFA456B6930
    • Cauldron master contract approved by the attacker: 0xE767C6C3Bf42f550A5A258A379713322B6c4c060
    • NXUSD token: 0xF14f4CE569cB3679E99d5059909E23B07bd2F387
    • NXUSD-3CRV pool used during exit: 0x6BF6fc7EaF84174bb7e1610Efd865f0eBD2AA96D
  • Response / mitigation:
    • In its own 2022-09-07 post-mortem, Nereus said the affected collateral type had been a recently launched AVAX/USDC Trader Joe LP market and that the exploitable condition was a missed TWAP step in the JLP price calculation.
    • The team said it liquidated and paused the exploited JLP market within hours, then covered the resulting roughly $500K of NXUSD bad debt from team treasury funds so the protocol remained overcollateralized.
    • Nereus also emphasized that the market had already been limited to a $1M security cap, which is worth preserving as a partial blast-radius control even though it did not prevent the exploit itself.
    • The longer-lived lesson from the mitigation is sharper than add TWAP: thin LP collateral should not be able to publish same-transaction borrowing power, especially when the borrower can both move the reserve state and force the exchange-rate refresh that Cauldron will honor.
    • Operationally, this case also shows why protocol-native or protocol-adjacent borrow assets do not neutralize oracle risk if the borrower can still route them into stronger exit liquidity during the same transaction.

Three collateral-and-credit promotions this incident collapsed

  1. A tiny LP position and a reserve-shaped valuation surface still existed

    • The attacker only needed about 0.04533097793130507 JLP, but that tiny position still pointed at a live Trader Joe reserve picture the borrower could reshape with flash-loaned size.
    • The dangerous fact was not simply JLP is an LP token; it was that one small wrapper position still rode on top of a same-transaction reserve surface the borrower could author temporarily.

  2. That borrower-shaped reserve picture was still promoted into canonical collateral truth

    • Nereus’s own postmortem preserved the core formula: LP price = (wavaxReserve * avaxPrice + usdcReserve * usdcPrice) / totalSupply, with no TWAP on the reserve inputs.
    • After the attacker stuffed the WAVAX-USDC pool, updateExchangeRate() published that manipulated reserve state as the JLP market’s live exchange rate, and Faraz’s reconstruction showed the borrow-relevant rate falling from roughly 88,793,190,826 to 32,701,350,550.
    • In other words, a pool-local, flash-loan-authored reserve snapshot was still over-promoted into the canonical solvency mark that Cauldron would honor.

  3. That published collateral truth still inherited immediate credit-and-exit authority

    • Once the manipulated mark was live, the market let the attacker borrow about 998K NXUSD against collateral Nereus itself later described as really worth only about $508K.
    • The damage persisted because that accepted JLP mark was not merely locally visible; it still carried live debt issuance authority through DegenBox and same-transaction exit authority through the NXUSD/Curve/USDC unwind path.

The reusable lesson is that a thin LP wrapper exists, that wrapper's reserve picture still counts as canonical collateral truth, and that accepted truth still deserves immediate protocol credit plus strong-liquidity exit authority are three separate promotions. Nereus collapsed all three into one borrower-controlled block.

Pattern tags

  • oracle-manipulation
  • lp-token-oracle-mispricing
  • Same-transaction oracle refresh / borrower-authored exchange-rate publication promoted directly into Cauldron debt authority
  • Thin LP-wrapper collateral treated as if reserve-shaped paper NAV were already executable borrowing power

Why the exploit worked

  • Nereus collapsed three different trust objects into one borrower-controlled moment: Trader Joe reserve state, the JLP oracle exchange rate, and Cauldron solvency. Once the borrower could move the pool and then immediately call updateExchangeRate(), the protocol was effectively letting the borrower author the collateral mark they were about to consume.
  • The specific oracle shape mattered. The JLP oracle read externally sourced AVAX and USDC prices, but multiplied those prices by live Joe pair reserves and then divided by LP totalSupply(). That meant the attacker did not need to corrupt Chainlink-style price feeds; they only needed to distort the reserve mix inside the WAVAX-USDC pair long enough for Nereus to snapshot it.
  • The reciprocal form of the exchange rate amplified the failure. Faraz’s reconstruction showed the published exchange rate fell from roughly 88,793,190,826 to 32,701,350,550; because Cauldron borrow capacity scaled inversely with that number, making the exchangeRate smaller made the same 0.04533 JLP collateral support far more NXUSD.
  • LP admission policy was also too trusting. The protocol treated a tiny Trader Joe LP position as if its displayed reserve-derived value were executable debt authority, rather than first haircutting it to weakest-leg unwind value or quarantining fresh marks before they could finance borrowing.
  • The payout rail completed the attack. NXUSD was not blue-chip exit liquidity by itself, but DegenBox plus available Curve and Trader Joe routes let the attacker turn that protocol-authored credit back into flash-loan-repayable USDC inside the same transaction window.
  • The preserved lesson is therefore broader than oracle manipulation: Nereus gave a thin LP wrapper, an externally callable publication step, and a borrow path immediate composition into one same-window balance-sheet object.

Detection and audit pivots

  • Enumerate every collateral market where the borrower can both move the underlying valuation venue and force the protocol to refresh its exchange rate or oracle state inside the same transaction. If those two powers coexist, the borrower likely owns solvency truth for one economic window.
  • Inspect reserve-derived LP or wrapper oracles for reciprocal semantics. In Cauldron-style markets the dangerous question is not only can the attacker pump the collateral mark upward? but also can they drive the published exchange-rate denominator downward so borrow power rises as the quoted rate falls?
  • Reconstruct the exact code path from oracle publication to _isSolvent or equivalent health checks. Nereus paid because updateExchangeRate() wrote the manipulated rate that cook() then honored immediately for borrowing.
  • Haircut LP collateral to executable unwind value rather than to reserve-shaped paper NAV. If a tiny LP position depends on a shallow or borrower-movable pool, the weakest constituent leg should set the credit boundary.
  • Model the exit asset, not only the collateral. If the protocol’s own stablecoin or house asset can still be routed through Curve, Trader Joe, or other deep venues before liquidation catches up, it is already strong enough to be an extraction medium.
  • Review whether asset-local pauses, collateral-factor clamps, isolated mode, or delayed activation could have stopped the exploit even after a bad mark was observed. If not, the protocol has no second boundary after oracle publication fails.

Failure-prevention checklist

  • Do not let borrower-movable reserve state become immediate borrow truth. If the same actor can manipulate the WAVAX-USDC pool and then call updateExchangeRate(), the protocol is effectively accepting user-written collateral marks.
  • Haircut LP collateral to executable weakest-leg unwind value rather than to reserve-shaped paper NAV. A 0.04533 JLP position should never support almost $1M of protocol credit just because one reserve leg was briefly flash-stuffed.
  • Separate observation from debt authority. A fresh or refreshed LP mark should be monitorable before it can support borrowing, liquidation, or recursive leverage in the same transaction window.
  • Bind LP listing, oracle-helper choice, collateral factor, and market cap into one risk decision. A $1M market cap limited damage here, but the stronger fix is refusing to grant thin LP collateral full same-window borrowing authority in the first place.
  • Require real manipulation resistance for non-Chainlink collateral paths. If a market must fall back to reserve-derived pricing, pair it with delays, severe caps, or isolation instead of treating it as ordinary money-good collateral.
  • Review payout-asset exits as part of collateral review. If borrowed NXUSD can be routed through Curve and Trader Joe back into flash-loan-repayable USDC, then the protocol has already exposed stronger balance-sheet assets than the collateral path deserves.
  • Keep asset-local kill switches fast and narrow. Nereus’s ability to pause and isolate the single JLP market after the exploit is worth preserving as a design requirement, not just as an emergency ops success.

Audit prompts

  • Which exact variables determine this LP mark: live reserves, LP totalSupply, an externally supplied underlying price, or some reciprocal exchange-rate transform on top of those inputs? Which of them can the borrower move before the protocol consumes the result?
  • Can the borrower both distort the underlying pool and force the protocol to publish that distorted mark in the same transaction, as happened through updateExchangeRate() here?
  • If the collateral is an LP token, what is the executable weakest-leg unwind value at the protocol’s allowed borrow size, and how far does that fall below the quoted reserve-based NAV?
  • Does the market treat recently launched collateral type as a reason for extra quarantine, or can a fresh listing immediately inherit ordinary collateral treatment before its pricing path has earned trust?
  • If a manipulated mark gets published, what still limits damage: isolated mode, debt caps, collateral factor 0, delayed borrowing, delayed liquidation, or only hope that the oracle was right?
  • Can the protocol’s own stablecoin or house asset exit into stronger liquidity fast enough to make an oracle mistake instantly monetizable? If yes, the borrow side is already a real extraction surface.
  • What objective evidence would justify this LP collateral today beyond the formula is onchain: depth analysis, unwind simulations, source-independence review, same-block manipulation tests, and bounded-loss caps?

Lessons that should already be standard

  • Same-transaction oracle refresh is already borrowing authority. If the borrower can both print and consume the collateral mark before arbitrage restores reality, the oracle is functionally user-authored.
  • LP token is not a safety upgrade over its weakest leg. Wrapping a manipulable WAVAX-USDC reserve picture in JLP did not make Nereus’s collateral model robust.
  • Market caps are blast-radius controls, not truth controls. Nereus’s $1M cap mattered, but it only limited the size of a bad collateral decision after the protocol had already honored it.
  • Protocol-native stablecoins do not neutralize oracle exploits when they still have same-transaction exit routes into stronger liquidity.
  • A reserve-based formula can be locally correct and still economically false for lending. The real question is what the protocol could liquidate or unwind for after the attacker stops supporting the manipulated pool state.
  • Fresh collateral listings deserve distrust by default. Recently launched plus non-Chainlink reserve-derived pricing should have implied quarantine rather than ordinary borrowing power.
  • Covering bad debt from treasury is a response success, not a substitute for collateral design. The security object is still the pricing path that decided how much NXUSD could be minted in the first place.

Why this incident matters

  • Nereus is a compact exemplar of LP-token oracle mispricing on Avalanche rather than Ethereum or BNB Chain, with Trader Joe reserve state sitting where Uniswap or PancakeSwap sat in earlier incidents.
  • It is also a good teaching case for same-transaction oracle refresh inside Cauldron-style lending integrations: the protocol did not just read a bad mark eventually, it let the borrower publish the bad mark at the exact profitable moment.
  • The case is especially useful because the downstream payout was NXUSD, not directly USDC; that makes the note a good reminder that a protocol-native stablecoin can still be a real extraction medium when Curve and DEX exit routes remain available.

Internal linkages

Control surface

  • The leverage sat in LP-collateral admission for the WAVAX-USDC Joe pair, externally callable exchange-rate publication, Cauldron borrow limits keyed to that exchange rate, and the protocol’s assumption that NXUSD release against that collateral mark was safe.
  • Nereus did not fail because an attacker found a weird edge case in Curve routing. It failed because a thin Trader Joe LP state was allowed to author solvency truth for a lending market.

Sources

Last reviewed

  • 2026-08-04 UTC

Graph View

Backlinks