An attacker flash-loaned 10 WBTC from Morpho and abused a share rounding vulnerability in ThetanutsFi's BTC/USD covered call vault. By depositing 2 satoshis first, then a large amount, they gamed the share-to-asset conversion math and drained the entire vault, netting ~0.15 WBTC profit after repaying the loan.
Victim: 0x80b8…a6f5
EXPLANATION:
The vault had no rounding protection on its share math. The attacker deposited 2 satoshis, receiving 1 share due to rounding down. Then deposited 4.68 WBTC, accumulating shares at a slightly better rate than they should have. Calling initWithdraw() burned all shares and returned the vault's full balance including pre-existing depositor funds. Classic inflation attack, tiny deposit first to skew the ratio, then drain everything.
Is $46K enough to get auditors to take rounding bugs seriously? 👇
🔔 @Observer • 💬 Join community • 🌟 HighQuality OTC