# ResupplyFi: share price manipulation drains $9.6M via oracle

ResupplyFi vault share price manipulated via tiny sCrvUSD mint and crvUSD donation, enabling 10M reUSD borrow and $9.6M drain.

- Payout: Real-world hack
- Severity: critical
- Program: ResupplyFi
- Credited: DeFiHackLabs
- Disclosed: 2025-06-26
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-06/ResupplyFi_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation vuln:share-inflation

**Target:** ResupplyFi lending vault and sCrvUSD oracle
**Root cause:** Vault share price derived from manipulable sCrvUSD exchange rate; attacker donated crvUSD to controller and minted 1 wei sCrvUSD to inflate collateral value.
**Steps:**
1. Flash loan 4,000 USDC from MorphoBlue.
2. Swap USDC for crvUSD on Curve pool `0x4DEcE678ceceb27446b35C672dC7d61F30bAD69E`.
3. Transfer 2,000 crvUSD to crvUSD controller `0x89707721927d7aaeeee513797A8d6cBbD0e08f41` and mint 1 wei sCrvUSD.
4. Approve and add 1 wei sCrvUSD as collateral to Resupply vault `0x6e90c85a495d54c6d7E1f3400FEF1f6e59f86bd6`.
5. Borrow 10,000,000 reUSD against inflated collateral.
6. Swap reUSD to crvUSD on Curve pool `0xc522A6606BBA746d7960404F22a3DB936B6F4F50`.
7. Redeem ~9,339,517 sCrvUSD for crvUSD.
8. Swap crvUSD back to USDC on Curve, repay flash loan, keep profit.
**Exploitation:** Attacker used a 4k USDC flash loan to manipulate sCrvUSD oracle via donation and minimal mint, then borrowed 10M reUSD against 1 wei collateral, swapped and redeemed to extract ~$9.6M.
**Escalation:** Small capital amplified via flash loan and oracle manipulation to borrow massive reUSD, then converted to stablecoins.
**Insight:** When a lending vault accepts a yield-bearing token as collateral, check if its exchange rate can be inflated by direct donation to the underlying controller or by minting a tiny amount; a 1 wei collateral can then back a huge borrow.