# Venus zkSync: wUSDM donation attack inflates exchange rate

Attacker donated USDM to inflate wUSDM exchange rate on zkSync, then liquidated own Venus position for 86.72 WETH profit.

- Payout: Real-world hack
- Severity: high
- Program: Venus_ZKSync
- Credited: DeFiHackLabs
- Disclosed: 2025-02-27
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-02/Venus_ZKSync_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250227-venus-zksync
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:flash-loan vuln:liquidation vuln:oracle-manipulation vuln:share-inflation

**Target:** Venus lending market on zkSync Era (wUSDM/vWETH)
**Root cause:** wUSDM's ERC-4626 exchange rate was derived from a per-chain donation-sensitive balance, so transferring USDM directly to the wUSDM contract inflated convertToAssets without minting shares, corrupting the price oracle used by Venus.
**Steps:**
1. Flash loan 2,100 WETH from Aave
2. Mint vWETH on Venus and enter vWETH market
3. Borrow ~466k wUSDM against vWETH, transfer to helper, mint as vUSDM collateral; repeat 4x
4. Borrow additional wUSDM, redeem shares for USDM at original rate
5. Transfer ~439,560 USDM directly to wUSDM contract to inflate exchange rate to 1.764
6. Self-liquidate the vWETH-collateralized account using helper's vUSDM, seizing ~1,493 vWETH
7. Redeem seized vWETH, borrow remaining WETH against leftover wUSDM collateral
8. Repay Aave flash loan, keep 86.72 WETH profit
**How found:** Post-mortem notes wUSDM supply on zkSync dropped from 5.33M to 1.27M after a 4M burn on Feb 24, making the exchange rate donation-sensitive; attacker recognized the small supply made price manipulation cheap and profitable.
**Exploitation:** Flash loan WETH -> recursive wUSDM borrow/supply across two wallets -> donate USDM to wUSDM to spike exchange rate -> trigger liquidation of own undercollateralized account -> redeem seized vWETH and repay loan, netting 86.72 WETH plus 55k wUSDM.
**Escalation:** Recursive borrow/supply loop amplified collateral to maximize liquidatable position and seized vWETH; donation amount tuned to push exchange rate just past liquidation threshold.
**Insight:** When a lending market uses an ERC-4626 vault's convertToAssets as oracle, check whether the vault's total assets can be inflated by direct donation (especially after large supply burns) — small total supply makes the donation cost tiny relative to liquidation profit.