Thetanuts Finance vault exploited for $46K through rounding manipulation in share-to-asset conversion, enabling attacker to extract depositor funds via flash loan.
Security & Exploits ·
Thetanuts Finance sustained a $46,000 loss on April 20 after an attacker exploited a rounding vulnerability in the protocol's Cash Settled Covered Call BTC/USD vault. The assault leveraged a flash loan of 10 WBTC from Morpho to manipulate share-to-asset conversion mechanics. The attacker first moved a minimal amount (2 satoshis) into the vault, receiving 1 share through downward rounding, then deposited 4.68 WBTC to accumulate additional shares at favorable rates against the vault's then-existing 0.15 WBTC reserve.
The core vulnerability lay in absent safeguards during share burning and asset redemption. By invoking initWithdraw() with maximum parameters, the attacker burned all accumulated shares and withdrew the vault's complete WBTC balance of 4.83 WBTC. This allowed extraction of funds belonging to other depositors through arithmetic precision gaps in the conversion formula. After repaying the 10 WBTC flash loan, the attacker retained approximately 0.1518 WBTC in profit.
The exploited contract remains unverified, and the precise scope of affected user positions has not been fully disclosed. The transaction is visible on-chain, though remediation steps and whether the project has issued guidance to affected liquidity providers remain unclear.