Resolv's $50M Exploit: A Flow Analysis of the Depeg and Its Aftermath

The attack was a precise, high-leverage flow event. An address used 100,000 USDC to mint 50 million USR, exploiting a vulnerability in the minting mechanism to create a massive oversupply. This sudden injection of tokens caused the price to briefly collapse to around $0.25, a severe depeg from its intended value.

The protocol reacted swiftly, suspending all functionality within hours to halt further activity. This rapid response prevented the initial exploit from being compounded, though the damage to price and trust was already done.

The Aftermath: Containment and Price Recovery

The attacker's second move was a direct attempt to maximize sell-side pressure. After the initial mint, the address spent an additional 200,000 USDC to mint 80 million USR, flooding the market with a massive new supply. This followed the earlier conversion of USR to ETH, which had already pressured the price during the exploit's peak.

The protocol's response was decisive. It suspended all functionality within hours of the first attack, halting further minting and trading to contain the damage. This suspension was critical in preventing the attack from escalating further.

Despite the severe initial depeg, the protocol's underlying design began to work. The system's delta-neutral hedging strategy and its dual-tranche structure, where RLP absorbs risk, provided a foundation for recovery. Once the malicious flows were stopped, USR's price started to climb back toward its $1 peg.

Catalysts and Risks: The Path Forward

The primary long-term risk is a sustained loss of user confidence, which could trigger outflows from both USR and RLP. The protocol's trust-restoration hinges on a transparent investigation, a clear plan for reimbursing losses, and demonstrable security improvements to prevent recurrence.

This attack is a stark reminder of the ongoing risk of smart contract vulnerabilities in complex DeFi protocols. Similar exploits have recently occurred at Yala and Solv, highlighting that even well-designed systems remain exposed to sophisticated reentrancy and minting flaws.

The path forward requires the protocol to move decisively from containment to rebuilding. Success will be measured by its ability to execute a credible recovery plan and prove its risk framework, as outlined by its risk manager, can withstand future attacks.