🚨 Flamincome.finance - Loss ~$346K (2026-09-16)

Token: $USDT
Network: Ethereum

Type: Oracle Manipulation (Curve virtual-price / share-price inflation)

Flamincome's USDT Strategy (0xb8d6...68a5) values its Convex/Curve position in impl.deposited() from BaseRewardPool.balanceOf(Strategy) × the Curve USDP metapool get_virtual_price plus its aUSDT reserves. Using a Morpho USDT flash loan the attacker bought USDP cheaply and imbalance-minted a large amount of the USDP metapool LP, deposited it into Convex and staked it FOR the Strategy (stakeFor), inflating balanceOfY()/per-share value. Redeeming YUSDT via VaultYUSDT.withdrawAll then forced the Strategy to pull ~544K aUSDT from Aave and pay out at the inflated price, netting ~$346K (victim strategy lost ~$595K in aUSDT+USDT).

TX: https://etherscan.io/tx/0x5ff8150482f5473bff16b4a142a98a7f72b159df5e9dd38afd90470551640d37
Attacker: https://etherscan.io/address/0x83381e7f7232775735169d72d237b858ffc36871
Victim: https://etherscan.io/address/0xb8d6471ca573c92c7096ab8600347f6a9fe268a5
X: https://x.com/flamincome

@defimon_subscription_bot