Vesper Finance hack — November 2021

At approximately 14:00 UTC on 2 November 2021 an attacker emptied Vesper Lend beta, a lending market that Vesper Finance ran as pool #23 on Rari Capital's Fuse platform. Vesper's post-mortem says the attacker borrowed roughly $3.5 million in assorted assets against collateral the market had been tricked into valuing at infinity, and that 735 ETH of the proceeds sat in one address at the time of writing. Vesper never published a final accounting, so that figure remains the team's own approximation.

The mechanism was oracle manipulation, not a contract bug. According to Vesper, the attacker withdrew 100 ETH from Tornado Cash, swapped 58 ETH for USDC, and bought every VUSD available in the 0.05 percent fee tier of the Uniswap v3 VUSD market, pushing that tier out of range. They then opened a new liquidity position of 0.1 USDC marked at a price of trillions of VUSD per USDC. The Fuse market took its VUSD price from that Uniswap v3 tier, read the collateral as effectively unlimited, and allowed the attacker to borrow the pool dry. VUSD, a low-liquidity beta stablecoin, was the weak point.

Rari Capital publicly described it as an isolated incident of oracle manipulation on pool #23 and noted that Fuse's customisability leaves oracle choice to the pool deployer. Vesper paused borrowing of VUSD and vVSP, set VUSD's collateral factor to zero, and coordinated with Rari, Yearn and Uniswap. Its Grow and Earn pools were unaffected and the VUSD collateral system stayed solvent. Co-founder Jeff Garzik said the team hoped to make everyone whole but would not promise it pending a full accounting; vVSP holders could only withdraw as liquidity returned.