Eleven Finance hack — June 2021

Eleven Finance, a yield aggregator on BNB Chain, had six of its Nerve Finance vaults drained on 22 June 2021. The affected vaults were 3nrv, anybtc/btc, anyeth/eth, nrv/busd, bfusd and nrvfusdt, and each lost its entire balance.

The flaw was in the emergencyBurn function of the ElevenNeverSellVault contract. The function returned a user's underlying deposit but never burned the corresponding vault shares, so a depositor could withdraw once through emergencyBurn and then call withdrawAll with the same, still-valid shares to take funds a second time. PeckShield's analysis describes the attacker funding the sequence with a flash swap of 953,869.62 BUSD from PancakeSwap, converting to NRV, adding liquidity, depositing the resulting LP tokens and then running the double withdrawal. Eleven Finance said the flaw had been present since the inception of the vaults rather than being a recent change, and that it had been overlooked in code review and in audits.

Loss estimates are close but not identical. Eleven Finance put the total at around $4.5 million, roughly 4 percent of its total value locked at the time, while PeckShield put it at about $4.6 million. PeckShield's write-up refers to at least four affected vaults, against the six listed by Eleven Finance.

The outcome was unusual. In a post published on 4 October 2021, Eleven Finance said it had recovered the full amount exploited from the Nerve vaults, the exploiter having swapped the stolen assets into stablecoins shortly after the attack. The team distributed an initial 25 percent refund in BUSD, funded partly by debt it took on, and later paid the remainder, ending close to full restitution after allowing for funds lost to intervening trades and bridging. No attacker was publicly identified.