Venus Incident

Summary#

On February 27, 2025, the wUSDM exchange rate was manipulated on Venus on zkSync.¹²

The attacker used two accounts to borrow and resupply wUSDM. The attacker then transferred 439,560 USDM directly (donate) to the wUSDM vault, raising the exchange rate from 1.0694 to 1.7641. Through self-liquidation, the attacker gained 86.72 WETH and 55,000 wUSDM.

The incident left Venus with about $902K in bad debt. The net loss after recoveries was about $716K.

Background#

USDM and wUSDM#

USDM is a rebasing stablecoin, which distributes yield by increasing token balances over time.

USDM balance = shares × rewardMultiplier

wUSDM is the non-rebasing share token of an ERC-4626 vault, enabling USDM to be used in DeFi protocols that do not support rebasing tokens. Yield is reflected in the amount of USDM redeemable per wUSDM.³

wUSDM/USD = convertToAssets(1 wUSDM) × USDM/USD

ERC-4626 and Exchange Rate#

Representative operations:

For example, a deposit creates the following state:

Vault totalAssets: 100 USDC
Vault totalSupply: 100 shares
 
1 share = 1 USDC

After a direct transfer of 10 USDC:

Vault totalAssets: 110 USDC
Vault totalSupply: 100 shares
 
1 share = 1.1 USDC

An ERC-4626 vault holds an ERC-20 asset. Anyone can transfer the underlying token directly to the vault without calling deposit(), increasing totalAssets() without minting new shares.

Venus#

Venus allowed wUSDM to be used as both a borrowed asset and collateral. Supplying wUSDM minted vwUSDM, which represented the supplied position.

Venus used convertToAssets to calculate the value of wUSDM. An increase in this value raised both the collateral value and debt value of wUSDM positions.

The wUSDM market used the following risk parameters.⁴

Self-Liquidation#

On Venus, an external caller triggers liquidation through the Core Pool’s Liquidator contract, repaying part of an undercollateralized account’s debt in exchange for collateral (Of course, only if liquidation conditions are met). In this incident, the attacker controlled both Account A and Account B and used B to liquidate A through this ordinary mechanism; this is referred to here as self-liquidation.

Incident Flow#

Sequence Diagram#

This diagram is reconstructed primarily from the Chaos Labs / Venus Protocol post-mortem ¹⁵. The author also used OpenZeppelin’s technical analysis⁶ to clarify selected intermediate steps. Repeated operations are simplified, and the State A/B snapshots and their balances are derived from the reports.

Preconditions:

• On February 24, wUSDM supply on zkSync fell from 5.33M to 1.27M, increasing the price impact of a direct donation.¹

Unable to render diagram.

Root Cause and Mitigation#

• Root cause: Venus used the wUSDM convertToAssets() rate without an upside guardrail. A direct USDM transfer increased totalAssets() without minting shares, inflating the value of wUSDM.¹⁶
• Amplifier: Low wUSDM supply on zkSync made the donation effective. The exchange rate increased from 1.0694 to 1.7641, or about 65%.¹
• Mitigation:
  • Cap exchange-rate growth with a CAPO.
  • Pause collateral and borrowing when the exchange rate changes abnormally or vault liquidity becomes too low.
  • Validate the rate against an independent or cross-chain reference.¹⁶

Incident Response#

All times are UTC.¹

Secondary Impact: Arbitrage reduced wUSDM supply on zkSync to below 10K; 575K wUSDM was acquired from SyncSwap and redeemed, and other Venus positions added about $49.6K of bad debt.¹

Recovery and Accounting: As of the March 27 post-mortem, Venus had recovered 71.48 ETH and 11,942 wUSDM through liquidation fees. Venus reported $902,159 in outstanding bad debt and a $716,789 net loss after $163,757 in liquidation fees and $21,613 in virtual bad debt.¹

References#