Structure of the attack: Price inflating and collateral deficit

Resupply is a stablecoin protocol that uses the liquidity and stability of Lending markets. However, the attackers broke the rate calculations on which this system was based through the token structures on Curve and Convex.

Flow of the event:

🎯 Target Token: Staked version of CVCRVUSD - Curve USD in Convex Finance.

💸 The attacker raised the price of this Token by sending donation.

🔄 The Resupplypair contract used this inflated price in the exchange rate calculation.

💥 Conclusion: The ratio collapsed, the system gave open.

🔓 The attacker borrowed 10 million Reusd with only 1 wei guarantee.

📣 PECKSHİELD CEO Xuxian Jiang:

“The attacker manipulated the CVCRVUSD case and received only 1 Wei and 10 million Reusd collaterals.”

🔁 Funds were transformed, contract was stopped

The attacker turned his Reusds into other assets in external markets. During these procedures, the protocol funds were completely evacuated.

The Resupply protocol confirmed the attack and announced that the affected smart contract was immediately stopped. More procedures were suspended for the protection of the remaining funds.

🧠 Technical Details: Defi’s chronic deficit

The attack was another example of the weaknesses of “Price Oracle” and “Collateral Valuation”, which are frequently seen in the defi ecosystem. Especially;

The risk increases when used in calculations of indirect price references (such as CVCRVUSD).

If the liquidity providers are not wide enough and robust enough, manipulation makes it easier.

If the dynamic price response of the Smart Contracts is weak, it becomes open to the attack.

🧭 EVALUATION: Stablecoin safety is re -questioned

This event once again revealed that Stablecoin protocols need solid infrastructures not only in areas such as safety of safety of intelligent contract and oracle, not only stable price.

Investors should examine in detail how the collateral systems are evaluated in defi protocols and on which assets are lending.