Loss: about $2.15M-$2.20M of bad debt after roughly $14.9M of borrows against the manipulated position
Summary: Over roughly nine months, the attacker accumulated about 12.2M THE on Venus, reaching about 84% of the market’s 14.5M THE supply cap. On 2026-03-15, they then bypassed that cap by transferring about 36M THE directly into the vTHE market contract instead of using the capped mint() path. Because Venus’s Compound-style accounting treated raw token balance as cash, that donation inflated the vTHE exchange rate about 3.81x without minting new vTHE. An attacker-controlled helper contract, already authorized to borrow against the primary wallet’s collateral, used the new borrowing power to borrow CAKE, BNB, WBNB, USDC, and BTCB, while also borrowing more THE, buying additional THE, and donating it back into vTHE in a recursive loop. The same operation pushed THE’s market price high enough that Venus’s Resilient Oracle eventually accepted about $0.51 instead of the pre-attack roughly $0.26, making the overgrown collateral position borrowable at the manipulated price. When buying pressure stopped, THE collapsed to about $0.22, liquidations could not realize anything close to the paper collateral value, and Venus was left with roughly $2.15M of bad debt.
Trigger / entry point:
Venus listed THE in the Core Pool with a 14.5M THE supply cap, but that cap only constrained the mintAllowed() / normal deposit path.
The vTHE contract still used Compound-style getCashPrior() / exchangeRateStoredInternal() logic that reads raw underlying balanceOf(address(this)), so direct transfers changed solvency-critical exchange rate without minting offsetting vTHE.
The attacker had already accumulated a dominant vTHE position over nine months, so exchange-rate inflation applied to a very large existing receipt-token balance.
Venus also let a delegate borrower contract use the primary wallet’s borrowing power, which made it easier to separate the donation / borrow loop from the original collateral holder.
THE itself was thin enough on external markets that sustained purchases could move the price materially, and the oracle eventually accepted the manipulated higher level once its sources converged.
Root cause:
Venus enforced the market supply cap only on the mint() path, not on direct ERC-20 transfers to the vTHE contract.
Because exchangeRate = (cash + borrows - reserves) / totalSupply, raw THE donations increased cash and therefore the collateral value of existing vTHE without creating new vTHE that the cap would count.
The protocol then combined that printable collateral quantity with an oracle path that could still be pushed upward on a low-liquidity token after enough buying pressure.
Liquidation assumptions failed too: once the collateral was massively oversized relative to real market depth, liquidation could not turn quoted THE value back into enough CAKE, BNB, BTCB, and stablecoins to keep Venus solvent.
In short: Venus treated THE supply exposure, vTHE exchange rate, and realizable liquidation value as if they were the same boundary, but the attacker could inflate each one faster than the protocol could constrain it.
Exploit path:
Between June 2025 and March 2026, funding wallet 0x7a79...f234 received 7,447 ETH through Tornado Cash, deposited that ETH into Aave, borrowed about $9.92M in stablecoins, and routed those funds into THE accumulation for the primary Venus supplier 0x1a35bd28efd46cfc46c2136f878777d69ae16231.
By the morning of 2026-03-15, that wallet already held about 12,234,411 THE on Venus, roughly 84% of the 14.5M THE supply cap.
At about 11:55 UTC, the attacker deployed helper contract 0x737bc98f1d34e19539c074b8ad1169d5d45da619 in transaction 0x4f477e941c12bbf32a58dc12db7bb0cb4d31d41ff25b2457e6af3c15d7f5663f and used it to start the exploit atomically.
Six wallets transferred about 36M THE directly into the vTHE contract, bypassing mintAllowed() and inflating the exchange rate from 10,086,934,836 to 38,420,106,438 (3.81x). The primary wallet kept the same vTHE count, but that unchanged position now represented about 45M THE of collateral instead of about 12M THE.
Inside the same attack flow, the helper contract borrowed about 1.58M USDC, re-supplied it, then borrowed about 4.63M THE and transferred that THE directly back into vTHE, further increasing exchange rate and effective collateral. It also pulled out about 910K CAKE and 1,972 BNB in the opening phase.
From roughly 12:00 to 12:42 UTC, the attacker repeated two linked loops: the primary wallet borrowed 100 BNB chunks and swapped them into THE with the swap recipient set directly to vTHE, while the helper contract ran additional borrow → swap → donate cycles. This pushed supplied THE from 49,525,348 at 12:00 to a peak of 53,230,145 at 12:42, or about 367% of the nominal supply cap.
In parallel, the attacker kept buying THE across the external venues that Venus’s oracle stack depended on. Venus’s BoundValidator reportedly rejected the spiking price for about 37 minutes, but once RedStone and Binance feeds converged high enough, the protocol accepted about $0.51 for THE instead of the pre-attack roughly $0.26.
At peak, the primary wallet held about 53.23M THE as collateral against borrows of 6,669,112 CAKE, 2,801 BNB, 1,972 WBNB, 1,581,461 USDC, and 20 BTCB. The helper contract separately held about 1,581,455 USDC as collateral against 4,628,904 THE debt.
Once the attacker stopped supporting the price, the position’s health deteriorated. THE collapsed to about $0.22, more than 42M THE of collateral was liquidated into thin liquidity, and the realized sale proceeds were far below the nominal value Venus had accepted.
The end state left the primary wallet with about 1,184,089 CAKE of bad debt and the helper contract with about 1,846,476 THE of bad debt, for a combined protocol hole of roughly $2.15M-$2.20M.
What the attacker needed to be true:
The attacker needed a dominant pre-existing vTHE balance so that donation-driven exchange-rate inflation would matter economically.
Direct THE transfers into vTHE had to bypass the supply-cap check while still counting toward cash in exchange-rate math.
Venus had to let delegated borrowing use the primary wallet’s inflated collateral from a separate helper contract.
External THE liquidity had to be thin enough that attacker-funded buying could drag the oracle stack upward.
Oracle validation had to eventually accept a materially higher THE price before liquidations started.
Liquidation markets had to be unable to monetize tens of millions of THE at anything close to the oracle-implied price.
Technical anatomy worth remembering:
This was not the classic almost-empty market -> 2 wei supply -> rounding under-burn exploit. The market already had a large outstanding position; the critical failure was that Venus counted raw donated balance as more collateral without routing that balance through the same supply-cap boundary as minted collateral.
The donation leg and the price leg were distinct. Donation inflated how much THE the attacker’s vTHE represented; spot buying and oracle convergence inflated how much each unit of THE was worth in borrow terms.
The helper contract mattered because it let the attacker borrow THE against USDC, donate that borrowed THE back into vTHE, and keep separating the mechanics of collateral inflation, price pushing, and asset extraction.
Venus’s risk controls failed in sequence rather than in one line: supply cap did not constrain direct transfers, oracle defense only delayed the manipulated price instead of preventing it, and liquidation could not realize nominal collateral value once the price reverted.
The nine-month buildup was also part of the exploit path. By the day of the attack, the attacker already controlled enough of the capped market that a donation multiplier became systemically meaningful.
Additional attack tx referenced in public reporting: 0xce6e3eb2a28ced1ef1c2212f36736e89f647365b0dfad6c9addc4c8b31f5fb0e
Response / mitigation:
Venus paused the affected THE and CAKE markets during the incident response and, out of caution, set collateral factor to 0 for several other concentrated BNB Chain markets.
Allez Labs / Venus published a post-mortem explicitly identifying the donation mechanic, thin-liquidity price manipulation, and concentration risk as the three compounding weaknesses.
Venus governance later proposed repaying roughly $2.203M of BNB Chain Core Pool bad debt using Treasury and Risk Fund assets, with most of the hole coming from CAKE and THE left behind by the incident.
The incident also revived attention to a 2023 Code4rena finding that had already described this supply-cap-bypass vector in Venus’s codebase but had not been remediated.
Venus did not lose only because THE was volatile. The protocol let raw donated THE mutate vTHE’s exchange-rate collateral quantity off the capped mint path, then later let a thin external market publish a price for that now-overgrown quantity, and finally assumed liquidation could monetize the paper value.
The exploit therefore crossed three distinct boundaries that weaker summaries often collapse together: how much THE exposure exists, what each vTHE unit claims on that exposure, and what price / liquidation depth the protocol is willing to honor for it.
This is also a useful boundary case between donation-style exchange-rate inflation and classic thin-market oracle abuse: the donation leg printed more collateral quantity, while the oracle leg printed more dollar value per unit of that quantity.
Why the exploit worked
Venus’s own post-mortem preserves the first decisive seam cleanly: mintAllowed() enforced the 14.5M THE supply cap only for normal mint() deposits, while VBep20.getCashPrior() still read raw IERC20(underlying).balanceOf(address(this)). That meant direct THE transfers changed the exchange-rate numerator without minting offsetting vTHE or touching the cap gate.
The attack only became systemically meaningful because the nine-month preparation phase had already concentrated about 12.2M THE — roughly 84% of the cap — in one wallet. Donation was not creating value from a dust foothold; it was repricing an already dominant receipt-token position.
The helper contract mattered because it let the attacker separate who holds the oversized collateral from who runs the recursive borrow / swap / donate loop. In practice, Venus let one wallet’s inflated collateral underwrite a second execution surface that could borrow THE, donate it back into vTHE, and keep amplifying exchange rate without first unwinding the primary position.
The oracle defense only delayed the second half of the trade. Venus reported that BoundValidator rejected the price for about 37 minutes, but once sustained buying pressure made RedStone and Binance converge, the protocol still accepted about $0.51 for THE. In other words, the oracle layer slowed the borrow-power expansion but did not stop a thin market from eventually validating the attacker-shaped price.
Liquidation was the final failed assumption. BlockSec’s reconstruction is useful here because it shows liquidation activity was heavy rather than absent: hundreds of bots competed across thousands of liquidation transactions, yet roughly $2.15M of bad debt still remained. The missing protection was not simply more liquidators; it was that tens of millions of THE never deserved deep-liquidity collateral treatment in the first place.
The sharper systems lesson is that Venus treated three different facts as if they were one: the market cap gate says exposure is bounded, the vToken exchange rate says each receipt is worth more underlying, and the oracle / liquidation stack says that underlying can be honored near quoted price. The attacker broke each promotion separately and monetized the gaps between them.
Detection and audit pivots
Trace every place a market cap, collateral cap, or isolated-mode limit is enforced, then ask which off-path state mutations still feed the solvency-critical accounting object. If direct transfers, fee accrual, debt repayment, rescue moves, or bridge-style balance updates can still rewrite cash, the cap is only constraining one lane.
Review Compound-style exchangeRate = (cash + borrows - reserves) / totalSupply markets as wrapper-price surfaces, not just money-market internals. If cash can move through uncapped or non-mint paths, the lending market has a donation-sensitive collateral-quantity oracle even before any external price feed is consulted.
Separate quantity truth from price truth during review. Venus failed first on how much THE existing vTHE should represent, then again on what market price to assign to that enlarged quantity. Audit paths that can cheaply inflate either side, and do not assume one healthy side compensates for the other.
Treat concentration drift as an exploit precondition, not just portfolio reporting. The decisive warning sign here was months of one actor climbing toward dominant ownership of a thin capped market; by the time the donation happened, the multiplier already had enough base to matter.
Stress liquidation realism directly. If a market can be grown to several multiples of its intended cap or if one holder can own most of the capped supply, test whether liquidators could ever unwind the resulting collateral at quoted oracle prices. If the answer is obviously no, the market should not retain ordinary collateral settings.
Audit delegated-borrow and account-manager paths together with collateral inflation risks. If one account can print or inherit inflated borrowing power while another account or helper contract spends it, seemingly secondary delegation features become part of the exploit surface.
Failure-prevention checklist
Enforce exposure limits on the actual solvency object the protocol later prices, not only on the friendly entrypoint. If direct transfers can change cash, either neutralize those balances, quarantine them, or include them in the same cap accounting before collateral power updates.
Treat raw-balance-driven vToken exchange rates as donation-sensitive wrapper marks. Thin or volatile markets using Compound-style cash accounting should get lower caps, lower collateral factors, isolated-mode treatment, or explicit off-path-balance handling before they are trusted as ordinary collateral.
Distinguish bounded deposit path, bounded collateral quantity, and bounded liquidation loss as separate controls. A market is not safe just because the UI deposit path stops at a cap.
Add abnormal-growth brakes between fresh exchange-rate expansion and borrow-side authority: same-block borrowing limits, asset-local pauses, supply-side quarantine, or delayed collateral recognition when cash jumps through non-mint paths.
Couple collateral settings to realizable exit depth, not only to circulating market cap or oracle source count. If liquidators cannot sell the collateral size implied by the protocol’s own caps, the listed cap is already too generous or the collateral factor is too high.
Monitor holder concentration and cap utilization as live exploit indicators. A thin market with one supplier approaching dominant ownership deserves tighter risk treatment before any donation, oracle, or liquidation event occurs.
Review delegated-borrow / credit-delegation features as part of the collateral threat model. If a helper contract can spend borrowing power minted elsewhere, test recursive borrow -> buy -> donate -> reborrow loops explicitly.
Require oracle and risk logic to fail narrower when thin collateral is moving violently. A delayed validator rejection is useful, but the safer default is often freeze new borrowing against this asset until price convergence proves durable rather than resume ordinary trust once feeds finally match.
Keep treasury and risk-fund remediation separate from the core control story. The protocol should be able to answer how the market would have remained solvent without socialized repair, not only how it plans to backfill the hole afterward.
Revisit known audit findings that describe harmless cap-bypass or donation surfaces whenever the same market later gains thin-liquidity collateral status. A medium-severity off-path balance issue can become treasury-critical once the protocol decides to lend deeply against it.
Audit prompts
What exact state does the protocol treat as how much underlying this receipt token represents, and can any off-path balance change mutate it without going through the same risk gate as deposits?
If the market advertises a supply cap, which flows bypass that cap while still changing cash, exchange rate, or collateral quantity?
Could one actor quietly accumulate enough of the capped supply that a later exchange-rate multiplier would become systemically meaningful rather than cosmetic?
Does delegated borrowing, account management, or helper-contract authorization let a second actor or contract spend borrowing power printed by the first actor’s inflated collateral?
If the collateral price were rejected for 30-60 minutes and then later accepted after venue convergence, what exactly would stop the protocol from simply resuming the exploit at a larger size?
What evidence shows liquidators could actually unwind the post-manipulation collateral size at anything close to quoted prices, rather than just compete over the first recoverable slice and leave the rest as bad debt?
Are risk parameters keyed to honest entrypoint usage (mint() deposits) or to economic reality (all balances that can influence collateral quantity and exit size)?
Which historical audit findings or prior incidents already described the same off-path-balance or donation mechanic, and what changed when the asset later became accepted thin collateral?
If cash doubled or tripled through direct transfers while totalSupply stayed fixed, what immediate limiter would stop that exchange-rate jump from becoming borrowable collateral authority?
When a thin market approaches extreme concentration, what exact operator or automatic control narrows collateral settings before an attacker gets to pair that concentration with price manipulation?
Lessons that should already be standard
A supply cap on one entrypoint is not a supply cap on economic exposure. If off-path balances still reprice the receipt token, the protocol has only capped the polite deposit path.
Compound-style cash accounting is a collateral oracle whenever the resulting exchange rate is used for borrow power. Raw balances deserve the same paranoia as wrapper pricePerShare or ERC-4626 convertToAssets marks.
Thin-market collateral safety has three separate questions: how much quantity can exist, what mark turns that quantity into dollar value, and whether liquidation can realize that value. Passing one does not answer the others.
Oracle delay is not oracle safety. A validator that rejects the first wave but later accepts manipulated convergence can still validate insolvency after the attacker has had time to build size.
Liquidator participation is not proof of healthy design. Hundreds of bots can show up and the protocol can still be insolvent if the collateral should never have been honored at that scale.
Concentration is not just a governance or UX metric. In thin collateral markets, dominant ownership is often the setup leg for later exchange-rate or price manipulation.
Credit delegation and helper contracts widen exploit surface even when they look operationally convenient. If one account prints inflated borrowing power and another account spends it recursively, both are part of the same solvency boundary.
Known donation has no negative side effects findings deserve to be re-scored when the affected market later becomes a live collateral source for deep-liquidity borrowing.
Why this incident matters
Venus THE is a useful hybrid incident for the corpus because it sits between two familiar families: donation-driven share / exchange-rate inflation and classic thin-market oracle manipulation. The attacker needed both.
It preserves a failure mode weaker summaries often flatten away: a supply cap can bound one deposit path while failing to bound the economic exposure the protocol actually prices as collateral.
It also shows that a delayed oracle rejection is not the same as safety. Venus’s BoundValidator slowed the attack, but once the manipulated venues converged, the protocol still accepted collateral value far above realizable liquidation value.
Compared with the earlier Venus zkSync wUSDM incident, this case shows the same protocol losing again to donation-shaped collateral inflation, but through Compound-style vToken accounting plus thin-spot price manipulation rather than ERC-4626 wrapper exchange-rate inflation.
Policy-boundary lens: entrypoint-only-policy-off-path-state-mutation — Venus bounded the official mint() path with a supply cap, but direct THE transfers still mutated the raw-balance cash state that vTHE exchange-rate and collateral logic actually trusted.
The decisive leverage sat in Venus’s getCashPrior() / exchange-rate accounting, the decision to enforce supply caps only on mintAllowed(), the oracle path that eventually accepted attacker-shaped THE prices, and liquidation assumptions that treated thin-collateral paper value as if it were executable at size.
Venus did not just list a volatile token. It let direct balance changes mutate the collateral quantity itself, then let a thin market decide that quantity’s price, and finally assumed liquidators could cash it out.