A TranchePool related to Fence Finance / Valinor / Oatfi on Avalanche was drained of about 1.013 million $USDC around 00:00 UTC on October 28. The root cause was not an oracle, but a settlement flaw that treated “the maturity date” as “already repaid.”
1. The attacker first used an Aave flash loan of about 1.013 million $USDC to set up the position (the pool still had funds at the time), then withdrew again at the daily rollover about three seconds later, draining the pool’s $USDC balance to zero.
2. Analyses by SlowMist and others point to the UTC daily settlement recording “scheduled principal repayment” as received, artificially inflating the amount available to borrow again. An independent fork reproduction also supports this explanation.
3. The stolen funds were subsequently bridged to the Solana side via a Circle CCTP burn-and-mint transfer. A message posted on-chain from the Fence side offered a 10% bounty in exchange for returning 90% of the funds.
4. Reminder: Pay special attention to “time boundaries” in RWA/credit pools—daily rollovers, maturity dates, and accrued interest. Changes in the books do not mean that funds have actually been received.
The incident involved the $AVAX ecosystem and $USDC in liquidity; traces after bridging may also involve the $SOL side.
For informational purposes only; this is not investment advice. DYOR. Use official channels only, and don’t click unfamiliar claim links.
#安全 #DeFi #USDC #AVAX #SOL
1. The attacker first used an Aave flash loan of about 1.013 million $USDC to set up the position (the pool still had funds at the time), then withdrew again at the daily rollover about three seconds later, draining the pool’s $USDC balance to zero.
2. Analyses by SlowMist and others point to the UTC daily settlement recording “scheduled principal repayment” as received, artificially inflating the amount available to borrow again. An independent fork reproduction also supports this explanation.
3. The stolen funds were subsequently bridged to the Solana side via a Circle CCTP burn-and-mint transfer. A message posted on-chain from the Fence side offered a 10% bounty in exchange for returning 90% of the funds.
4. Reminder: Pay special attention to “time boundaries” in RWA/credit pools—daily rollovers, maturity dates, and accrued interest. Changes in the books do not mean that funds have actually been received.
The incident involved the $AVAX ecosystem and $USDC in liquidity; traces after bridging may also involve the $SOL side.
For informational purposes only; this is not investment advice. DYOR. Use official channels only, and don’t click unfamiliar claim links.
#安全 #DeFi #USDC #AVAX #SOL