# Venus THE: borrowBehalf + donation attack drains CAKE/WBNB

Attacker drained pre-approved THE from six EOAs, donated it into Venus vTHE to inflate collateral, then used borrowBehalf to borrow USDC/CAKE/WBNB against a victim's account.

- Payout: Real-world hack
- Severity: critical
- Program: Venus THE
- Credited: DeFiHackLabs
- Disclosed: 2026-03-15
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-03/Venus_THE_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260315-venus-the
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Venus vTHE/vUSDC lending markets on BSC
**Root cause:** borrowBehalf lets an attacker open debt on behalf of an arbitrary victim, and direct THE donations into vTHE inflate the exchange rate/collateral value of the victim's vTHE position without the victim's consent.
**Steps:**
1. Fork BSC at block 86731940 (attack block -1).
2. Drain THE from six EOAs that had pre-approved the future attack-contract address via `transferFrom`.
3. Donate the THE directly to vTHE (`THE.transfer(address(VTHE), amount)`) to inflate vTHE exchange rate.
4. Call `VUSDC.borrowBehalf(VICTIM, USDC_BORROW_AMOUNT)` to open USDC debt on the victim while USDC is sent to attacker.
5. `USDC.approve(VUSDC, amount)` then `VUSDC.mint(amount)` to mint vUSDC collateral.
6. `COMPTROLLER.enterMarkets([vUSDC])`.
7. `VTHE.borrow(THE_SELF_BORROW_AMOUNT)` and donate THE back into vTHE to further inflate victim collateral.
8. `VCAKE.borrow(CAKE_BORROW_AMOUNT)` and `VWBNB.borrow(WBNB_BORROW_AMOUNT)` on the victim's behalf, extracting 913,858 CAKE + 1,972 WBNB.
**How found:** Trace-driven reconstruction: attacker identified EOAs with outstanding THE approvals to a not-yet-deployed contract address, and recognized that borrowBehalf permits opening debt on any victim while donation-based exchange-rate inflation raises that victim's collateral valuation.
**Exploitation:** Pre-approved THE allowances on six EOAs were harvested, donated into vTHE to inflate the victim's collateral value, then borrowBehalf was used to open USDC debt attributed to the victim while the borrowed USDC flowed to the attacker. The attacker minted vUSDC, entered the market, borrowed THE, re-donated it to vTHE to further inflate collateral, and finally borrowed CAKE and WBNB against the victim's now-overvalued position.
**Escalation:** Iterative donation loop: borrow THE, donate back to vTHE, re-inflate collateral, then borrow additional assets (CAKE, WBNB) on the victim's behalf.
**Insight:** Look for lending functions that let you specify an arbitrary borrower (borrowBehalf-style) combined with donation-inflatable exchange rates — the victim's collateral can be pumped for free while debt is attributed to them, so scan for pre-approved allowances to undeployed addresses as the funding source.