TranchePool Exploit Results in $1.01 Million Loss
TranchePool on Avalanche suffered an exploit due to a settlement logic flaw, leading to a loss of over $1 million. The flaw allowed an attacker to draw USDC twice from the pool.
A TranchePool associated with Valinor Digital, Oatfi, and Fence Finance was exploited, resulting in a loss of approximately $1.013 million. The incident occurred due to a flaw in the settlement logic, where a scheduled principal payment was incorrectly processed as received. This error artificially restored the draw capacity, enabling the attacker to withdraw the same amount of USDC a second time.
The exploit took advantage of the UTC day rollover, which played a critical role in the flawed logic. By manipulating the system's understanding of the payment status, the attacker was able to exploit the pool's mechanics. The specific chain involved in this incident was not stated, which limits the ability to trace the transactions directly.
The on-chain record does not provide specific addresses related to the exploit, but the incident highlights the vulnerabilities that can exist within smart contract logic. The loss of over $1 million underscores the importance of rigorous testing and auditing of financial protocols in the crypto space.