Loss: roughly 3.37M−3.5M drained from Vesper-managed Rari Fuse Pool #23
Summary: The attacker turned Vesper’s low-liquidity house stablecoin VUSD into effectively infinite collateral inside Vesper’s own beta Fuse market. They first bought almost all available VUSD from the Uniswap v3 VUSD/USDC 0.05% pool and pushed the pool to the maximum tick, then let the pool’s 600-second TWAP climb for several blocks. Pool #23 trusted that Uniswap v3 TWAP through Rari’s MasterPriceOracle, so the market began valuing VUSD at absurd levels. The attacker then deposited about 222k VUSD as collateral and borrowed out essentially every stronger asset in the pool. The important preserved lesson is not just Uniswap v3 oracle manipulation; it is that a Vesper-managed lending pool let a thin Vesper-issued stablecoin become money-good collateral against the rest of the balance sheet.
Trigger / entry point:
Vesper’s Fuse Pool #23 admitted VUSD as collateral and priced it from a Uniswap v3 TWAP on the thin VUSD/USDC 0.05% pool.
The attacker used their own capital, not a flash loan, to buy out almost all VUSD liquidity and pin the Uniswap v3 pool at max tick.
Because Pool #23 used a 600-second TWAP, the manipulated spot price had to persist across blocks, but concentrated liquidity made that wait short rather than prohibitive.
Once the TWAP rose high enough, the attacker only needed to deposit the inflated VUSD and call ordinary Fuse borrow functions.
Root cause:
Pool #23 treated a thin Vesper-issued asset as if a Uniswap v3 TWAP on one shallow venue were durable collateral truth.
Concentrated liquidity made the trusted oracle far easier to distort than a comparable v2-style full-curve AMM because the attacker could burn through the active range at relatively modest cost and leave the pool parked at max tick.
The design was also reflexive: a Vesper-run market accepted Vesper’s own beta stablecoin as collateral, so local ecosystem pricing of a house asset controlled how much external value could leave the pool.
The failure was therefore not merely oracle choice; it was house-asset collateral policy plus an oracle venue whose manipulation cost was far smaller than the pool reserves it protected.
Exploit path:
The attacker address 0xa3f447feb0b2bddc50a44ccd6f412a5f98619264 funded itself with about 100 ETH from Tornado Cash.
It swapped part of that ETH into about 232,509 USDC and used the Uniswap v3 VUSD/USDC 0.05% pool as the manipulation venue.
In transaction 0x89d0ae4dc1743598a540c4e33917efdce24338723b0fabf34813b79cb0ecf4c5, the attacker bought essentially all available VUSD, pushing the pool’s current price to the Uniswap v3 maximum tick.
The same transaction also minted a tiny LP position worth only 0.1 USDC at an absurd price range; later replay work suggests that dust LP was not actually required for the exploit, but it appeared in the original attack path.
Because Pool #23 consumed a 600-second Uniswap v3 TWAP, the attacker waited across blocks while the oracle absorbed the max-tick state. Public replay analysis shows the TWAP moved from about 0.988964 USDC/VUSD before manipulation to about 1,293 after one 37-second block and then kept compounding higher, reaching about 1.960630954978808896e12 USDC/VUSD by block 13537932.
With the oracle now marking VUSD at a fantastical value, the attacker deposited the acquired VUSD into Vesper’s Fuse Pool #23 as collateral.
In transaction 0x8527fea51233974a431c92c4d3c58dee118b05a3140a04e0f95147df9faf8092, they borrowed out essentially all available assets from the pool, commonly reported as roughly $3.5M in aggregate.
The attacker then swapped and consolidated the stolen assets, with Vesper’s first-day incident note highlighting about 735 ETH sitting in the attacker address after the drain.
What the attacker needed to be true:
VUSD liquidity on the trusted Uniswap v3 oracle venue had to be shallow enough that a few hundred thousand USDC could drive the pool to max tick.
Pool #23 had to accept VUSD as collateral for materially stronger assets.
The pool’s TWAP window had to be short enough that the manipulated price became borrowable before arbitrage or emergency response restored the market.
Borrow caps and collateral settings had to leave enough pool inventory available that one inflated VUSD deposit could evacuate most of the market.
Technical anatomy worth remembering:
This was not a flash-loan oracle attack. The attacker had to commit capital across blocks because the pool used a TWAP, but Uniswap v3’s concentrated-liquidity design made the wait commercially tolerable.
The exploit is a strong protocol-native collateral fragility case even though VUSD was nominally a stablecoin rather than a governance token. It was still a Vesper-issued house asset whose local liquidity profile did not justify the solvency role it was given.
The max-tick state is what makes this incident historically useful. A Uniswap v3 pool parked at the extreme edge of its price lattice can make a short-window TWAP explode much faster than intuitive TWAP should smooth this out reasoning suggests.
Public replay analysis is also useful because it shows that the attacker included a tiny extreme-range LP mint that was probably unnecessary. That matters for pattern-matching: the real exploit primitive was buyout plus TWAP drift, not some deep dependency on a cleverly positioned dust LP.
Pool #23 being isolated did contain blast radius to that market, but it did not protect depositors inside the market itself. Isolated pool is not the same as safe collateral design.
Inflated-collateral deposit and borrow transaction: 0x8527fea51233974a431c92c4d3c58dee118b05a3140a04e0f95147df9faf8092
Rari MasterPriceOracle highlighted in public writeups: 0xb3c8ee7309be658c186f986388c2377da436d8fb
VUSD minter contract used in public replay analysis of the original transaction: 0xb652fc42e12828f3f1b3e96283b199e62ec570db
Manipulated market: Uniswap v3 VUSD/USDC 0.05% pool
Response / mitigation:
Vesper coordinated with Rari, Yearn, and Uniswap immediately after the incident.
The team paused borrowing of VUSD and vVSP on Pool #23, set VUSD collateral factor to zero, and paused other activity while assessing the blast radius.
Vesper emphasized that conservative grow pools and the VUSD collateral system itself remained solvent, while Pool #23 depositors absorbed the isolated-pool losses.
The practical fix was not just change the oracle: it was also stop treating a thin house asset as strong collateral.
Concentrated-liquidity max-tick oracle capture: the attacker only had to buy through the active Uniswap v3 range once, then let a 600-second TWAP inherit a parked max-tick state
House-stablecoin collateral fragility: VUSD was nominally a stablecoin, but its real security boundary was still Vesper-local liquidity depth and Vesper’s willingness to honor that depth as collateral truth
Thin local price, deep reserve outflow: a few hundred thousand USDC of venue control unlocked borrowing rights over millions in stronger Pool #23 assets
Why the exploit worked
The cleanest lesson is not TWAP failed; it is Vesper let its own thin stablecoin become borrow authority against stronger reserves. Once Pool #23 admitted VUSD as collateral, a local VUSD/USDC price on one shallow Uniswap v3 pool became the balance-sheet gate for the rest of the market.
The oracle venue was far weaker than the reserves it protected. Vesper’s own incident writeup and cmichel’s replay both preserve the same asymmetry: about 232k USDC was enough to buy out the active VUSD liquidity, while the market would later honor that attacker-shaped mark for roughly $3.5M of borrowable assets.
Uniswap v3 concentrated liquidity made the 600-second TWAP much more fragile than the words time weighted suggested. After the manipulation parked the pool at max tick, cmichel’s replay shows the TWAP jumping from about 0.988964 to about 1293 after one 37-second block, then compounding upward until it reached about 1.960630954978808896e12 by the borrow transaction block. The smoothing window existed, but the market depth behind it did not.
Pool isolation only limited contagion to Pool #23. It did not protect users inside the market from the core mismatch: VUSD had thin, Vesper-local support, while the assets borrowable against it were the market’s strongest inventory. Isolated was therefore a blast-radius property, not a solvency proof.
The enduring design error was collateral admission, not borrow-function logic. The attacker used ordinary Fuse flows after the protocol itself certified absurd VUSD marks as real collateral value.
Detection and audit pivots
Ask whether a protocol-issued stablecoin is actually being treated like a house asset for risk purposes. If most real depth sits on one nearby venue and the same protocol ecosystem defines both issuance credibility and collateral admission, the asset is still reflexive even if it is named stablecoin.
Compare cost to dominate the active oracle range with value borrowable once the mark is honored. Vesper is the clean reminder that concentrated-liquidity TWAPs can have a dramatically smaller manipulation budget than the reserve book they underwrite.
Separate TWAP exists from TWAP is safe. Reviews should model how fast a max-tick or edge-of-range state enters the averaging window, not just how long the window is on paper.
Trace the exact reserve-outflow path after the oracle move. If one shallow local market can underwrite WBTC, ETH, DAI, and USDC withdrawals from the same pool, collateral policy is already too generous even before any code-level oracle bug appears.
Treat pool isolation, beta labels, and permissionless listing disclaimers as containment descriptions, not defenses. They do not answer whether the listed collateral deserves money-good status inside that pool.
Failure-prevention checklist
Treat protocol-issued stablecoins like protocol-native collateral until they prove independent executable depth. Stablecoin branding is not a substitute for outside liquidity, redemption credibility, and liquidation capacity.
Do not let a thin house asset move directly from price readable to full collateral semantics. Start with low collateral factors, strict borrow caps, isolated usage, or collateral disabled until the venue mix and exit depth justify more trust.
Size risk limits against the cost to dominate the active Uniswap v3 range, not against nominal TVL or the comforting presence of a TWAP window.
Require depth-aware oracle review for concentrated-liquidity pools: who provides the active liquidity, how much capital moves the pool to range edges, and how quickly does that edge state contaminate the chosen TWAP horizon?
Couple collateral admission and reserve-outflow controls. If a house asset can only be exited on one shallow venue, the market should not let it unlock the pool’s deepest assets at full size.
Add asset-local circuit breakers for extreme range-edge behavior: pause fresh borrowing or zero the collateral factor when the trusted pool is pushed out of range, when one account’s collateral value jumps implausibly fast, or when the oracle diverges violently from expected stablecoin bounds.
Keep the emergency playbook aimed at derecognition, not only oracle swapping. If the credible post-incident fix is set collateral factor to zero, that control should already be central to normal risk management.
Treat beta / isolated pools as requiring stricter listing standards, not looser ones. Blast-radius containment is not permission to let shallow house collateral back stronger reserves.
Audit prompts
If this stablecoin lost its protocol badge and were reviewed as a third-party thin asset with one main venue, would it still be allowed to back WBTC, ETH, DAI, and USDC borrowing at the same size?
How much capital is required to push the trusted Uniswap v3 pool to a range edge or max tick, and how many blocks does the configured TWAP need before that state becomes meaningful collateral value?
What is the largest reserve outflow the market will honor before arbitrage, governance, or pauses can react, and how does that compare with executable depth on the asset’s primary venue?
Does the protocol have automatic behavior for stablecoin no longer trading near par or trusted pool pushed fully out of range, or is the response still manual and social?
Which stronger assets can be drained against this collateral, and are they capped tightly enough that one attacker-authored local mark cannot evacuate most of the pool?
Is the reviewed asset economically independent of the protocol that honors it, or does the same issuer / community / local DEX ecosystem effectively underwrite both the quoted price and the protocol balance sheet?
If the market is isolated, what exact user protection still exists inside that market once the collateral mark is wrong? If the answer is mostly none, isolation is not solving the core solvency question.
What objective condition would force this collateral back into quarantine or collateral factor zero before an exploit proves the market was too thin?
Lessons that should already be standard
A protocol-issued stablecoin can be as reflexive as a governance token if its real liquidity is local and shallow.
TWAP smooths time, not range-edge fragility. A concentrated-liquidity pool parked at max tick can poison a short averaging window much faster than teams expect.
Isolated pool means contained failure, not sound collateral design.
The right oracle question is not is there a price? but can this market absorb liquidation and unwind flow anywhere near the credit we are extending against it?
Beta disclaimers do not change balance-sheet math. If the protocol honors a printed collateral mark for real reserve withdrawals, the solvency failure is real even in an experimental market.
When the emergency fix is zero the collateral factor, the pre-incident mistake was collateral admission, not only oracle implementation.
House-asset collateral should earn trust slowly and lose it quickly; local liquidity that can be bought through in one transaction should never underwrite the pool’s best reserves.
Why this incident matters
It is one of the clearest real-world examples of Uniswap v3 concentrated liquidity turning a short TWAP window into a much weaker oracle than protocols expected.
It also rounds out the house-asset collateral corpus with a stablecoin-shaped cousin to Moola’s MOO and Mango’s MNGO: the dangerous asset did not need governance rights, only thin local liquidity plus collateral admission.
The case is especially worth preserving because the attacker did not exploit a code bug in Fuse’s borrow logic. They exploited collateral policy and oracle venue design until the protocol itself certified absurd collateral as spendable truth.
Positive-design companion: collateral-admission-lag-and-borrow-side-quarantine — useful when the sharper follow-up becomes why a protocol-issued but thin stablecoin should have stayed capped, quarantined, or collateral-disabled until real outside depth existed.
Positive-design companion: oracle-independence-inventory-and-degraded-mode-discipline — useful when the healthier-side question becomes how to review whether a nominally external price path is actually economically independent enough for solvency use.
The leverage sat in VUSD collateral admission, the Uniswap v3 oracle venue, the 600-second TWAP configuration, and Pool #23’s willingness to let a thin Vesper-issued asset back borrowing of much stronger pool reserves.
Vesper’s beta Fuse market did not mainly fail because the attacker found a new borrow primitive. It failed because the market treated local VUSD price discovery as if it were robust enough to certify real solvency.