fix: enforce CAPO on ERC4626Oracle to prevent donation attacks#305
Open
floflo777 wants to merge 2 commits intoVenusProtocol:developfrom
Open
fix: enforce CAPO on ERC4626Oracle to prevent donation attacks#305floflo777 wants to merge 2 commits intoVenusProtocol:developfrom
floflo777 wants to merge 2 commits intoVenusProtocol:developfrom
Conversation
ERC-4626 vault tokens are vulnerable to exchange rate manipulation via "donation attacks" where an attacker directly transfers underlying tokens to the vault contract, inflating convertToAssets() without creating new shares. This was exploited on Venus ZkSync (wUSDM, Feb 2026) causing $716K in bad debt. Multiple oracle deployments had snapshotInterval=0, completely disabling the CAPO (Capped Asset Price Oracle) mechanism and allowing attackers to use inflated exchange rates as collateral prices. Changes: - ERC4626Oracle constructor now rejects deployment without CAPO params (annualGrowthRate > 0 and snapshotInterval > 0 required) - Fixed sUSDe, wUSDM, BNBx, SlisBNB, AnkrBNB, WBETH, asBNB deployment scripts to use proper CAPO parameters (24h snapshot interval, 10-15% annual growth cap, 1% safety gap) - Added DonationAttack.ts test proving the vulnerability and fix
Adds a PriceCircuitBreaker oracle wrapper that detects rapid price drops and trips a circuit breaker, blocking further oracle queries until governance resets it. This addresses the THE (Thena) token attack on Venus BSC (March 15 2026) where the attacker: 1. Had 53M THE ($28M) as collateral on Venus 2. Borrowed BNB, CAKE, BTCB against it 3. THE price crashed from $0.528 to $0.237 (-55%) 4. Left ~$3.7M+ in bad debt for Venus The PriceCircuitBreaker would have: - Detected the >30% price drop within the 1-hour window - Tripped the circuit breaker, reverting all getPrice() calls - Prevented further borrowing against crashing collateral - Required governance to manually reset after investigation Changes: - New PriceCircuitBreaker.sol oracle wrapper contract - PriceCircuitBreaker unit tests (9/9 passing) - THEAttackPoC fork test reproducing the attack via impersonation - DonationAttackPoC and FullAttackSimulation fork tests - MockERC4626 test helper - BSC hardfork config in hardhat.config.ts for fork testing
|
BSC_RPC_URL=<your_rpc> npx hardhat test test/fork/THEAttackPoC.ts |
Armanidashh
approved these changes
Mar 30, 2026
Armanidashh
approved these changes
Mar 30, 2026
|
floflo777:fix/enforce-capo-oracle-donation-attack |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two critical security fixes for Venus Protocol oracle system.
1. ERC-4626 Donation Attack Prevention (CAPO Enforcement)
Multiple ERC-4626 oracle deployments had
snapshotInterval=0, completely disabling the CAPO mechanism. This leaves them vulnerable to the same donation attack that hit Venus ZkSync (wUSDM, Feb 2026, $716K bad debt).Fix:
ERC4626Oracleconstructor now rejects deployment without CAPO (reverts withCAPORequired). All deployment scripts updated with proper CAPO parameters.2. PriceCircuitBreaker - Low-Liquidity Token Attack Prevention
Addresses the THE (Thena) token attack on Venus BSC (March 15, 2026) where:
The
PriceCircuitBreakeris an oracle wrapper that:getPrice()callsPoC / Reproduction
The THE attack is reproduced on a BSC mainnet fork via attacker impersonation at block 86738200:
Files changed
contracts/oracles/ERC4626Oracle.sol- Enforce CAPOcontracts/oracles/PriceCircuitBreaker.sol- New circuit breakerdeploy/*- Fixed CAPO parameters for all ERC-4626 deploymentstest/DonationAttack.ts- ERC-4626 donation attack PoC (6/6)test/PriceCircuitBreaker.ts- Circuit breaker tests (9/9)test/fork/THEAttackPoC.ts- THE attack fork reproduction (3/3)Test plan