# Sonne Finance: precision loss in soVELO market drains $20M

Sonne Finance's soVELO market suffered precision loss in exchange-rate math, letting an attacker mint 2 wei of soVELO, donate VELO, and borrow ~$20M against it.

- Payout: Real-world hack
- Severity: critical
- Program: Sonne Finance
- Analysis by: DeFiHackLabs
- Disclosed: 2024-05-14
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-05/Sonne_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240514-sonne
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:flash-loan vuln:governance vuln:oracle-manipulation vuln:precision-loss

**Target:** Compound-fork lending market (soVELO cToken) on Optimism
**Root cause:** Exchange-rate/share accounting in the soVELO market rounded in the attacker's favor, so a 2-wei mint plus a large VELO donation inflated collateral value far beyond actual deposit.
**Steps:**
1. Fork Optimism at block 120062493-1
2. Execute 5 queued TimelockController proposals on soVELO and Unitroller (set params, add market, set collateral factor)
3. Approve VELO to soVELO
4. Flash-borrow 35,469,150,965,253,049,864,450,449 VELO from VolatileV2 USDC/VELO pool via `swap(0, amount1, this, hex"01")`
5. In swap callback: `soVELO.mint(400_000_001)` to mint 2 wei soVELO
6. Transfer entire VELO balance to soVELO to inflate exchange rate
7. `enterMarkets([soUSDC, soVELO])`
8. `soUSDC.borrow(768_947_220_961)` (~$768k USDC)
9. `soVELO.redeemUnderlying(Velo_amount_of_soVelo_after_transfer - 1)` to recover donated VELO
10. Repay flash loan (VELO + 44,656,863,632 USDC fee)
**Exploitation:** Attacker flash-borrowed VELO, minted a dust amount of soVELO, donated the borrowed VELO to the market to spike the exchange rate, then used the inflated soVELO collateral to borrow USDC and redeem the donated VELO, repaying the flash loan and keeping the borrowed USDC as profit.
**Escalation:** Repeated across two attack transactions/contracts totaling ~$20M; used TimelockController.execute to push governance proposals enabling the market parameters.
**Insight:** Compound-fork cToken exchange rates are vulnerable when a market can be seeded with dust shares then inflated by direct token donation; check whether redeemUnderlying/mint rounding lets a tiny share count capture donated value, and whether governance timelock proposals can be executed permissionlessly to set favorable collateral factors.