RedSonic Vault Exploit Drains 9.25 ETH in Ethereum Flash Loan Attack
TLDR:RedSonic Vault lost 9.25 ETH after an attacker exploited a dual-asset pricing flaw entirely.A permissionless registerErc20 function let the attacker add a second, conflicting stETH share class.The attacker flash-loaned 1,139 WETH from Balancer and needed zero starting capital of their own.ExVulSec traced the full exploit, including the Curve swap and the final loan repayment step. A flash loan attacker drained 9.25 ETH from Ethereums RedSonic Vault in a single transaction. Blockchain security firm ExVulSec identified the exploit and published a full technical breakdown. The attacker manipulated a permissionless asset-registration function to double count the same underlying collateral. On-chain records show the entire operation executed inside one self-contained transaction. How the RedSonic Vault Exploit Unfolded The attacker flash-loaned 1,139 WETH from Balancer to fund the entire operation. No upfront capital of their own was required. RedSonic‘s vault prices its rsvETH shares through a function called getTotalAssetBalance. For the Lido position, that function reads the vault’s raw stETH balance directly. That design choice became the exploits foundation. Share prices tied directly to a raw balance can shift if that balance changes unexpectedly. No corresponding shares need to be minted or burned. Discover more Engineering & Technology Currencies & Foreign Exchange Digital Currencies The vaults registerErc20 function carried no access restrictions, according to ExVulSec.
