# Curve LlamaLend: sDOLA share-price manipulation enables mass liquidation

Attacker flash-loaned $10M USDC and WETH to manipulate sDOLA share price, then liquidated Curve LlamaLend crvUSD borrowers for ~$240K profit.

- Payout: Real-world hack
- Severity: high
- Program: Curve LlamaLend
- Credited: DeFiHackLabs
- Disclosed: 2026-03-02
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-03/Curve_LlamaLend_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260302-curve-llamalend
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:liquidation vuln:oracle-manipulation vuln:share-inflation

**Target:** Curve LlamaLend crvUSD controller and sDOLA/LLAMMA AMM pools
**Root cause:** sDOLA share price (convertToAssets) is manipulable via large swaps through the alUSD/sDOLA and SAVE_DOLA stableswap pools; the attacker inflated sDOLA value to make crvUSD loans appear undercollateralized, then liquidated them.
**Steps:**
1. Flash-loan 10M USDC from Morpho, then nested flash-loan all WETH from Morpho.
2. Swap USDC->alUSD via alUSD_FRAXB3CRV_F.exchange_underlying(2,0,7M).
3. Swap alUSD->sDOLA via alUSD_sDOLA.exchange(1,0,650k) to skew sDOLA price.
4. Deposit WETH as collateral, create_loan on crvUSD_Controller_2 for 25M crvUSD.
5. Deposit crvUSD into scrvUSD, swap SAVE_DOLA and LLAMMA to further skew sDOLA.
6. Redeem sDOLA, stake DOLA into DOLA_SAVINGS to inflate sDOLA.convertToAssets.
7. Call LLAMMA_CRV_USD_AMM.exchange(0,1,0,1) to update oracle, then deploy AttackContract2 to liquidate all users from crvUSD_Controller.users_to_liquidate().
8. Mint sDOLA, unwind swaps, repay flash loans, swap residual USDC->WETH, profit ~$240K.
**Exploitation:** Two nested Morpho flash loans (10M USDC + all WETH) fund large stableswap trades that skew sDOLA share price. Attacker opens a crvUSD loan, deposits into scrvUSD, manipulates sDOLA.convertToAssets upward, triggers LLAMMA oracle update, then liquidates every borrower in users_to_liquidate() at a discount. Unwinds positions and repays flash loans, netting ~$240K.
**Escalation:** Chained share-price manipulation with mass liquidation of all undercollateralized users in a single transaction, amplified by nested flash loans.
**Insight:** sDOLA's convertToAssets depends on stableswap pool balances that can be skewed by a single large swap; any lending market using a manipulable share-price oracle for liquidation thresholds is exploitable via flash-loan-funded pool skew followed by forced oracle update and batch liquidation.