Fence.finance exploited for $1M on Avalanche via flash loan and logic bug enabling unauthorized debt forgiveness and fund drainage across lending tranches.
Security & Exploits ·
Fence.finance sustained a $1 million loss on Avalanche through an exploit targeting a logic flaw in an unverified contract, with the attacker incurring approximately $507 in transaction costs. The protocol's lending architecture pools multiple tranches within a single smart contract, where each tranche involves lenders making deposits against a borrower's draws. Configuration parameters for each tranche are validated by comparing them to a stored hash, but the contract permits anyone to establish a new tranche if they provide the admin address—enabling an attacker to self-designate as both administrator and hook contract.
On October 27 at 23:56 UTC, the attacker executed a flash loan of 1,013,353.61 USDC from Aave V3 and instantiated a tranche under its own control. Holding all roles, the attacker deposited the borrowed amount, scheduled a matching repayment obligation using admin privileges, and withdrew the full sum as the designated borrower before repaying Aave. The timing proved critical: when the attacker withdrew again after the date rollover to October 28, the protocol's debt accounting recognized the scheduled repayment as satisfied despite no actual payment, clearing the borrowing limit. This discrepancy between debt tracking and withdrawal validation allowed the attacker to drain 1.013 million USDC that belonged to lenders in a separate tranche, emptying the shared balance across all tranches.
Whether additional funds remain at risk or whether the protocol has implemented safeguards remains unconfirmed. The setup and exploit transactions are publicly recorded on-chain.