⚠️The Resolv USR exploit ⚠️ $100k USDC → 80M unbacked USR minted in minutes via a broken requestSwap/completeSwap flow. Attacker extracted ~$25M, USR crashed to pennies, and it rippled into Gauntlet vaults + other curators. https://defiprime.com/resolv-usr-exploit --- Link Preview --- [Defiprim
Security & Exploits ·
At 2:21 AM UTC on March 22, an attacker converted $100,000 in USDC into approximately $25 million in extracted value by exploiting a broken minting mechanism in Resolv Labs' USR stablecoin. The protocol's two-step minting flow—requestSwap() followed by completeSwap()—lacked on-chain validation between the deposit amount and the quantity of USR issued. The SERVICE_ROLE, an externally owned address rather than a multisig, could pass arbitrary mint amounts to completeSwap() without bounds checks or price-oracle verification. The attacker deposited between $100,000 and $200,000 across multiple requests, triggering the minting of approximately 80 million USR—a 400x to 500x over-mint—roughly 50 million in one transaction and 30 million shortly after.
Resolv had previously raised $10 million in seed funding from backers including Coinbase Ventures and held over $500 million in total value locked across integrations with Morpho, Aave, Euler, and Curve. The protocol's design relied on USR, a delta-neutral stablecoin collateralized by ETH, staked ETH, and Bitcoin with perpetual futures hedging, paired with a junior tranche token, RLP, intended to absorb losses. However, USR's market capitalization had contracted from roughly $400 million in early February to around $100 million by late March—a 75% decline occurring before the exploit.
The damage cascaded through lending vaults and DEX liquidity pools, including Gauntlet-managed vaults and other curators holding USR positions. Security analysis pointed to either a compromised private key controlling the service role or the complete absence of amount validation between request and completion phases. Whether the earlier TVL decline reflected insider unwinding, yield migration, or foreknowledge remains unresolved.