Minterest hack — July 2024

Minterest, a cross-chain lending protocol, lost about $1.4 million on 14 July 2024 in an attack on its mUSDY market on Mantle Network. The project's own post-mortem places the exploit between 16:24 and 16:28 UTC+3, a window of about four minutes.

The attacker took a flash loan of 4.265 million USDY from an AGNI pool and, separately, borrowed roughly 392,773 USDY through Minterest's own flashLoan function to move the exchange rate, then reentered through the lendRUSDY function. Transferring the borrowed tokens lowered the market's cash balance and shifted the exchange rate mid-transfer; re-entering at the depressed rate minted more mTokens than the deposit warranted, and withdrawing the underlying at the correct rate left surplus mTokens with nothing behind them. Minterest says the cycle ran 25 times, building roughly $1.7 million of position value in the USDY market, which was then borrowed against to remove $1.4 million of WETH and mETH. Halborn's independent write-up describes the same two defects: an exchange rate updated immediately after a borrow, and a reentrancy that allowed previously borrowed tokens to be lent back.

Minterest identifies the attacking wallet and the exploit transaction, says the wallet was funded through Tornado Cash, and reports the proceeds were bridged from Mantle to Ethereum via Stargate and converted to ETH through Squid Router. Deployments on Ethereum and Taiko were unaffected.

The protocol suspended operations across chains, flagged the wallet with exchanges and Etherscan, and engaged SEAL 911 and BlockSec. It applied a 15% reduction to WETH and mETH supply balances to account for the stolen funds, refunded liquidation fees by 24 July, and compensated affected suppliers with discounted MINTY tokens vesting 20% at listing and 80% over six months, alongside a 40% boost to MNT and MINTY emissions for three months for suppliers holding over $50 before the exploit.