🚨Just wtf happened with @ResolvLabs?!?
On paper: $100K $USDC deposited → $80m unbacked $USR minted → $25M swapped out → peg obliterated to $0.25.
Not Lazarus 0-day hack scenario but likely basic negligence with the minting logic.
A simple DeFi architecture 101: Off-chain calc + blind on-chain exec = guaranteed disaster at some point.
Potential attack vectors were:
1️⃣ Pyth oracle Manipulation (unlikely the casue since its non trivial)
2️⃣ Compromised off-chain validator (most likely)
3️⃣ Missing amount validation (CONFIRMED bug)
Root cause was the classic "trust me bro" with their hybrid on/off-chain minting mechanisms.
WAT MEEN?!
Onchain logic had missing checks on off-chain output. which basically gave off chain "SERVICE_ROLE" = god mode access that could turn-> $100K collateral → $80M $USR
The Exploit Flow:
1️⃣ requestSwap(100K USDC)
2️⃣ Off-chain service calls → completeSwap(80M $USR)
3️⃣ Contract mints. No checks.
Missing checks that could have prevented this:
❌ No _mintAmount <= collateral * MAX_RATIO
❌ No supply cap
❌ No oracle re-validation on-chain
❌ SERVICE_ROLE "offchain minting coputation" = god mode access -> $100K → $80M.
Always math. Always verify. Never trust!!!! 💀
Resolv Labs
@ResolvLabs
03-22
The previously disclosed exploit involving ~80M unbacked USR remains under active investigation.
Until further notice, we strongly recommend avoiding trading or interacting with Resolv assets at this time to prevent supporting secondary market activity related to the exploit. x.com/ResolvLabs/sta…
Crazy how one missing check can nuke entire protocol instantly.
Sector:
From Twitter
Disclaimer: The content above is only the author's opinion which does not represent any position of Followin, and is not intended as, and shall not be understood or construed as, investment advice from Followin.
Like
Add to Favorites
Comments
Share
Relevant content
