Value DeFi (vStake pool) hack — May 2021

On 5 May 2021 at 03:22 UTC an attacker took over the vStake profit-sharing pool for the vBSWAP token on Value DeFi's BNB Chain deployment. The pool's initialize() function was missing the line that marks a contract as initialized, so it could be called a second time by anyone. The attacker re-initialized it, made themselves the operator, and then used the pool's own emergency recovery function to withdraw the staked LP tokens.

According to Value DeFi's post-mortem the attacker removed 10,839.16 vBSWAP/BUSD LP tokens, redeemed them for 7,342.75 vBSWAP and 205,659.22 BUSD, sold the vBSWAP for 8,790.77 BNB on 1inch, converted to renBTC and bridged the proceeds to Bitcoin. The team attributed the missing line to a merge error when the code was copied from an earlier Reserve Fund contract, said no other pool carried the flaw, and committed to a 12-hour timelock on critical functions and to buying cover from an insurance partner.

The dollar figure is disputed. The researcher Igor Igamberdiev, whose on-chain analysis was reported by CoinGape, valued this incident at about $6 million; The Defiant put it at $10 million. Value DeFi published no USD figure of its own. The gap reflects the difference between what the attacker realised on sale and the pre-attack market value of the tokens.

Value DeFi announced a compensation plan using 2,802.75 vBSWAP from its Reserve Fund plus the 205,659.22 BUSD, with a community vote on how to mint the remaining 4,540 vBSWAP. Two days later the same protocol lost a further sum in a separate exploit of its vSwap AMM pools. The stolen funds were not recovered.