Resupply Loses $9.5 Million in Smart Contract Exploit

Stablecoin platform Resupply suffered a significant exploit resulting in a loss of $9.5 million. The attack involved an attacker manipulating the price of cvcrvUSD, a wrapped version of Curve USD (crvUSD) staked on Convex Finance. By sending donations to the cvcrvUSD vault, the attacker inflated the token’s share price, which was then used as collateral to borrow Resupply’s native stablecoin, reUSD, at an extremely favorable exchange rate.

The Resupply smart contract, ResupplyPair (CurveLend: crvUSD/wstUSR), utilized the manipulated cvcrvUSD price in its calculations. Once the attacker borrowed the reUSD, the manipulated exchange rate collapsed, leading to a major devaluation of the protocol’s reserves. Analysts at Blocksec noted that the attacker primarily drained funds from the wstUSR market by exploiting the flawed price logic in the borrowing function. The stolen reUSD was then swiftly converted into other crypto assets on external markets.

“As a result, the attacker borrowed massive reUSD with just 1 wei of cvcrvUSD as collateral, bypassing the insolvency check,” Blocksec wrote on X. Resupply acknowledged the breach in a statement and confirmed that the compromised contract has been paused. The team is investigating the incident and has not yet confirmed any recovery plans. “A full post-mortem will be shared as soon as a complete analysis of the situation has been conducted,” the team wrote.

This incident highlights the vulnerabilities in smart contract logic and the potential for price manipulation in decentralized finance (DeFi) protocols. The exploit underscores the importance of robust security measures and thorough audits to prevent such attacks. Resupply’s response, including pausing the affected contract and initiating an investigation, is a crucial step in mitigating further damage and restoring trust in the platform.