Adversarial ERC-4626: How Vault-Share Manipulation Still Bypasses Listing Screens in 2025

Transcript

Hello. Thanks. Uh, hi. I'm a security researcher at Open Zeppelin and uh, I'm going to talk about uh, wallshare manipulation and er in ERC 4626 walls. Well, this vulnerability has existed for a long time. We've probably known about it for like 4 years since the walls uh, were first proposed. And we've seen a lot of hacks because of this in the past. And um somehow uh they have gone down in number but they aren't they haven't been completely eradicated yet. And so this presentation is about um the hacks that still happened this

year and uh what we can learn from them and prevent them for from happening in the future. All right. So let's talk about the wault. So, ERC 4626 uh was uh proposed like four years ago in 2021. Uh did the screen go blank? Okay, it's fine. Okay, it went blank again. I should probably not step on the wire. I'm sorry. So, yeah, they were proposed four years ago. I think most of the people in the room are probably familiar with them. Um they are basically for eelbearing tokens. uh you could deposit assets. Those assets are put to use in

some other protocol. They earn earn yield and for that uh you're given like share tokens which you can always redeem uh for the underlying assets and um they are okay. I think all right it's back again. So uh it's a very widely adopted standard in D5 now. Um can you please see what's happening? I don't know what's causing the issue now. All right. So I I'll continue um while we see what the problem is. Um so these vault basically maintain an

internal exchange rate between the amount of underlying assets and the shares that the vault has minted. So, um let me try to move to the next slides. So, uh the biggest the I I'd say the elephant in the room uh with the RC 4626 volts is the exchange rate. uh because this exchange rate how it's calculated usually depends like uh it it's it's it's what usually on it's the thing on which basically uh it depends whether the wault is secure or not and whether the integrations uh in other protocols are secure or not.

Any protocol that uses uh these wa tokens may be at risk if the exchange rate can be manipulated. So um should I continue or should I stop the I should go. Okay. All right. All right. So usually this exchange rate is calculated u by dividing the total number of assets that the vault has been given to or deposited by the total number of shares. But um there are two ways to actually get the assets into the wault. One is by using the deposit or mint functions. The other you can you can just donate assets to the vault by by using like an ERC20

transfer. So that can increase the exchange rate artificially and which may not be good for integrating protocols. So integrating protocols usually to get uh to see like how much the shares are worth uh call the um convert to assets function. say supply uh a number of shares to the function and that gives you the number of assets. So imagine let's say a uh lending protocol is using rab staked ETH and it wants to know like how much is is a wraed staked ETH worth in STE. So they can just call the convert to asset functions and then they'll get uh the amount of stake deed then they can use let's say a chain link

oracle that is that supplies them the price of stake deed to USD and then you know they can uh basically use the functions of the lending protocol determine how much collateral how much health factor and uh whatever else is required. So, does this mean that using ERC 4626 volts in your protocols means that you're wrecked? Um, not necessarily. So, let's see um what it really depends on. So, there I'd say there are a few preconditions for any kind of hack in integrating protocols to happen.

First is that the convert to assets function or any other function that provides the exchange rate of a of a ER64626 vault is used. Secondly, usually you have to take the vault to a really low share supplier uh because at that point uh any kind of donation you do just gets amplified because there aren't a lot of shares in in the vault and the amount of assets become very large. So and the third thing is the integrating vault um doesn't do any sanity checks on the exchange rate. So uh if a really large price or a really low price is supplied, it just uses that

uh as the correct correct price and that uh is what becomes problematic. All right. So let's quickly go to go through the two hacks that happened this year uh due to walshare manipulation. The first is the Venus hack on ZKY Sync era blockchain. Um in this one basically um so for context uh Venus is a folk of um compound V2 uh which is a lending pro protocol um which okay um you do that uh I'll I'll just continue with it. So is a uh so Venus is

a fork of compound V2. The assay that was used here that was vulnerable was Rabb USDM uh which is just an ERC26 ERC 4626 vault where okay all good um where USDM is the underlying asset and WSDM is is the is the share token. So in this case the vault offered no production against donations and um the exchange rate uh uh the convert to assets function was used for the exchange rate in in Venus and it was combined with the chain link oracle which provided USDM price in USD.

All right. So the attacker first took a flash loan of a lot of wheat and then they opened two types of position. was they deposited uh uh VET and borrowed all the W USDM from the market and then they opened another position where they deposited W some amount of WSDM. So they had from another account. So they had two positions one in which they borrowed WSDM and one in which they lent WUSDM. Then they took the uh remaining WSDM redeemed it for USDM. uh so that took the vault supply very low and then they donated the redeemed USDM uh to inflate the exchange

rate from 1.07 to 1.7. So after this uh they were able to liquidate the the position in which they borrowed WSDM and in the other position where they had provided it as collateral they were able to borrow other assets. So uh this is how they pro profited and uh then there were other things because the vault had a really high exchange rate. Then uh they were also able to use that to arbitrage over some AMMs where they bought WSDM redeemed it and then uh dumped the USDM.

So uh this is a flowchart on how it happened. If you see on point number two right here where the price is returned uh that is 1.7 USDM that's the problem. It should have been uh 1.07 and that is what u ended in the hack. The se the second example is uh the resupply hack. uh in this uh resupply is um CDP vault that issues a token against collateral and uh the asset is uh the asset that was used as collateral which was uh ERC 462 ERC 4626 vault which was empty. Now this must ring some bells in if there

are any security researchers here due to the first deposit bug that everyone is familiar familiar with but this is not what what happened here anyway. So it was an empty vault and um the convert to assets function was used again. So resupply uh listed uh CRV USD if that's the as I think that's the name of the vault token as collateral and it was an empty vault. So what uh the hacker did was they donated u about 2,000 E18 worth of um tokens

uh to the vault and then they uh called deposit function and minted one way of shares and they took the exchange rate to 2 E18 and um uh because the exchange rate was so much um um the so another thing is the exchange rate was very high now at this point and the vault was empty now they went to so this is the code if you'd see uh they tried to use some dead shares here which was um I think the value was thousand but it did not really make much of a difference because they donated a lot of assets so let's come to resupply code

quickly so if you See the price was fetched uh using the convert to assets function by passing in 1 E18. 18 was the number of decimals. Now the hacker was already able to manipulate the price to 2 E18 which after multiplying them u returned like 2 E36 and the [clears throat] exchange rate which was calculated here this uh resulted in zero. uh so and this exchange rate was used in the issolvent function uh right here.

So the LTV became zero uh of the hacker and uh this check passed and so they could supply any small amount of uh collateral and they were able to mint till the maximum supply for the collateral which was like 10 million USD. So this is how the hack happened also due to Walsh share manipulation. So yeah, so what was missed in the listing checks of these collateral assets? Well, they just checked if the if there was a price oracle uh and which was there but it was exploitable.

this they checked whether the there was deep dex liquidity but that didn't really matter and there was no check how much initial liquidity there was or how much the price per share can grow in any amount fixed amount of time. So all these checks were lacking and they had like no supply and debt caps and in this in the case of resupply fire the there was a debt cap but it was really high for an empty vault. So what did we learn from uh both these hacks?

So there are two parts of it like for vault creators who are creating the uh ERC 4626 vaults and and then therefore uh learnings for integrators. So for wault creators uh Oiler actually wrote a really phenomenal blog on this um last year which is called like exchange rate manipulations in ERC 4626. So please go through it. Uh I'll cover some of the points in very brief uh detail. So first you could just use an initial deposit where uh if you're listing a vault or um if you're deploying a vault just dep uh just call it deposit or mint function and make

sure um you have some initial liquidity. So a lot of first deposit bugs and vshure manipulation cannot happen due to low low supply of shares. You could also use virtual deposit where instead of depositing something just you add a certain amount to uh the total assets. Let's say whenever you're calculating the exchange rate you add like a,000 or one E6 one E6 to to the total assets. That also helps a lot. It wouldn't actually prevent it but it's still a good measure. You could do internal asset balance tracking. So instead of calling the balance of function, you track the amounts of balance that keeps on increasing whenever deposit or mint happens or

whenever the total assets grow due to wherever you've invested it. Um you could also average the share price. So instead of the share price increasing uh at once, whenever increase happen, it's averaged out through a few hours. That would also make it more difficult to manipulate it, manipulate the share price. And you could also track the exchange rates explicitly like whatever the exchange rate is. It's if it's 1.07, you just track that. You don't track the assets or balances. And uh then you could also add to app to it and whatever you want. So

uh [sighs and gasps] all right. And you can also discard stealth donations stealth donations which is what happens u due to rounding uh due to rounding when like if you're trying to deposit three way of something but you only get tokens for two way of something and one way just gets added to added to the assets. So um you could you could discard that by keeping an explicit track of it. All right. What are the learnings for integrators? Well, um firstly, do not use ERC 46 4626 price per share uh uh these tokens um as the uh borrowable asset or base asset uh without caps like supply like very

very explicit caps and um try to use them as collateral until well until they mature. uh have dead ceilings, have um caps for the price that you want. Um uh when your listing requires some initial TVL and uh initial supply um because with empty vaults they are really really easy to manipulate. And uh another thing you could do is uh as the integrator you could provide some liquidity to the vault itself and you can burn that or put that into your treasury. So you're always sure that um the share amount or the total supply

cannot go down by a lot uh like in dangerous territories because you are also you also hold some shares. Another really good uh um defense is to use a correlated asset price oracle uh where you supply how much you expect the vault price to grow and it keeps a track of it and um every time the price is uh the convert to assets function is called in this case it's latest round data but it could just be convert to assets. It just tracks how much time has passed and how much the yearly growth we expect and it doesn't let the price to

grow grow more than that because um if the max ratio is less than the current ratio it just swaps it around. So all right so move quickly um could also use quill switches like uh uh this is like a monitoring recommendation uh if the price per share has moved by a lot or or the liquidity shrinks by a lot um you could just pause the market um there's another thing you could do um before calling the convert to assets function you can check the total supply of the vault and uh you can have a threshold and if the total supply is below the threshold you can just revert and wait till the time the vault has more more shares.

You can use market price oracles if they're present. Um uh with poodle oracles it's it's it's really easier to get price for a whole lot of other newer or tail tail end assets is uh but it's not always possible and most importantly have a listing checklist and this is for all the integrators and curators everyone have a listing checklist have a certain um things that you check for every asset you um list as a collab collateral or or you make a market for a base asset, have it out, have all all the check all of these things. Uh because so this is an

example. Um we built this listing checklist for compound when uh we were used to work with compound. And um you could you could take this for uh see this was for inspiration and uh so this is something that we explicitly checked every time when we were listing an asset on compound whether like um the if and a vault token is used whether it's uh share price is manipulable or not. So don't depend on audits. So don't say that this token has already been audited so we don't need to see it. So every time what we used to do even if it had audits we always tried to see if in some way we can manipulate uh

the share price by donating by still donating by doing all all all sorts of things by you by taking a flash loan out of the vault. So you just need to be very vigilant and um yeah so ERC 4626 is not broken um but integrations are and uh if you integrate these tokens well even and if they're made well even if they aren't like even if their share price is a bit manipulable there are way many def there are a lot of defenses that you can use.

So yeah, that's about it, man. Um, all right. Uh, does anyone have any question? I think we have time for one. >> No, >> I do have a question. >> Yeah, >> h how do you how do you ensure over time that the share rate is not inflated? Because uh usually inflation happens right when the bot is deployed uh when it has zero shares. But what if everyone withdraws all of their funds and it becomes empty again in the future? Have you thought about that?

>> Right. So, uh if I go back, so if you as a uh vault deployer um use some initial deposit, right? So you can always make sure that it never goes back to zero, right? And that yeah, that that solves the problem. >> All right. Um thank you guys. That's it. That's my time. Um, [applause] [applause]