{"investigation":{"slug":"deus-finance","entity_name":"DEUS Finance","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"DEUS Finance is a decentralized derivatives and synthetic asset protocol built primarily on Fantom, co-founded by Lafayette Tabor and Mohammad Abrishami. The protocol suffered three separate security exploits between March 2022 and May 2023, resulting in combined losses exceeding $22 million across flash loan oracle attacks and a smart contract implementation flaw, with stolen funds routed through Tornado Cash in the 2022 incidents. Repeated security failures across distinct vulnerability classes raise severe concerns about the protocol's security practices and long-term viability.","sections":[{"content":"DEUS Finance is a DeFi derivatives protocol that allows users to trade tokenized representations of real-world assets such as stocks and commodities in a decentralized manner. It was co-founded by Lafayette Tabor (Founder and Project Lead) and Mohammad Abrishami. The protocol operates primarily on Fantom, with additional deployments on Arbitrum, Ethereum, and BNB Smart Chain. Its ecosystem is powered by two native tokens: DEUS (governance and utility) and DEI, a fractional-reserve stablecoin pegged to the US dollar. The Muon network provides off-chain oracle data to the protocol's smart contracts. Users can lock DEUS tokens for veDEUS, which grants governance rights and exposure to platform fees. As of early 2022, the protocol held approximately $16–18 million in total value locked (TVL) on DeFiLlama before its first exploit reduced that figure.","heading":"Background","sources":[{"url":"https://bitcoinist.com/deus-finance-the-next-generation-multi-asset-defi-protocol/","name":"","type":"other","credibility":3},{"url":"https://defillama.com/protocol/deus-finance","name":"","type":"other","credibility":3},{"url":"https://www.crunchbase.com/person/lafayette-tabor","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"DEUS Finance sustained three documented security incidents between March 2022 and May 2023, collectively resulting in losses exceeding $22 million.\n\n**Exploit 1 — March 15, 2022 (~$3 million, Fantom):** An attacker used flash loans to manipulate the Muon oracle, which sources price data from USDC/DEI pools on Solidly and Spirit DEXes on Fantom. By distorting the DEI/USDC price within a single transaction, the attacker triggered cascading liquidations and user insolvencies. Approximately 200,000 DAI and 1,101.8 ETH (totaling roughly $3 million) were extracted. Initial funds to seed the attack were withdrawn from Tornado Cash and bridged to Fantom via Multichain; profits were bridged back to Ethereum and laundered through Tornado Cash. Core developer Lafayette Tabor stated the team deactivated affected contracts and pledged reimbursement via smart contract using personal and DAO funds. CoinDesk and The Block both reported on this incident.\n\n**Exploit 2 — April 28, 2022 (~$13.4 million, Fantom):** Less than 45 days after the first attack, a second flash loan oracle exploit drained approximately $13.4 million from a DEUS liquidity pool on Fantom. The attacker borrowed over $143 million in a flash loan and used it to purchase 9.5 million DEI tokens, artificially inflating DEI's price above its $1 peg. The inflated DEI was then used as collateral to borrow an additional 17.2 million DEI using only 71,000 DEI as collateral. After repaying the flash loan, the attacker retained approximately $13.4 million. The on-chain transaction hash for this attack is documented as 0x39825ff84b44d9c9983b4cff464d4746d1ae5432977b9a65a92ab47edac9c9b5 on FTMScan. Stolen funds were again bridged from Fantom to Ethereum and routed through Tornado Cash. DEUS stated that no user funds were directly lost and that the loss fell on the protocol. The DEUS token fell approximately 16.5% within 24 hours of disclosure. This attack exploited the same class of oracle manipulation vulnerability as the March incident, indicating the initial patch had not fully addressed the root cause.\n\n**Exploit 3 — May 5, 2023 (~$6.5 million, BSC/Arbitrum/Ethereum):** Approximately one year after the April 2022 exploit, a third incident targeted the DEI stablecoin contract across three chains. The vulnerability was a code logic error introduced during a contract upgrade: the burnFrom function had its allowance parameters reversed — _allowances[_msg.sender()][account] was used instead of the correct _allowances[account][_msg.sender()]. This allowed an attacker to call burnFrom with a victim's address and a zero amount parameter, bypassing the allowance check entirely and burning the victim's tokens. Losses were approximately $5 million on Arbitrum, $1.3 million on BNB Smart Chain, and $135,000 on Ethereum, totaling roughly $6.38–$6.5 million. The DEI stablecoin depegged significantly, trading as low as $0.20 against its intended $1 peg. The team paused all contracts and subsequently conducted a partial white-hat recovery, with approximately 5.5 million out of 7 million DEI-equivalent tokens reported as recovered and placed in a 2/3 multisig managed by @lafachief and members of Yearn Finance. CertiK noted that while it had audited DEUS Finance's AMM product in June 2021, the DEI stablecoin contract where the vulnerability existed was outside that audit's scope.","heading":"Multiple Exploits (2022–2023)","sources":[{"url":"https://www.coindesk.com/tech/2022/03/15/derivatives-platform-deus-finance-exploited-for-3m-on-fantom-network","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/137817/deus-finance-dao-suffers-3-million-flash-loan-attack","name":"","type":"other","credibility":3},{"url":"https://cryptobriefing.com/deus-finance-suffers-3m-oracle-exploit/","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2022/04/28/how-deus-finance-was-exploited-for-134m-on-fantom","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/linked/143969/deus-finance-flash-loan-exploit-nets-hacker-13-million","name":"","type":"other","credibility":3},{"url":"https://cryptobriefing.com/defi-hacker-steals-13-4m-deus-finance-attack/","name":"","type":"other","credibility":3},{"url":"https://therecord.media/more-than-13-million-stolen-from-defi-platform-deus-finance","name":"","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/stablecoin-stumble-the-code-bug-led-to-usd6-5-million-loss-on-deus-finance","name":"","type":"other","credibility":3},{"url":"https://crypto.news/deus-finance-hacked-over-6m-dei-stablecoin-stolen/","name":"","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/single/deus-finance-exploited-for-13-4-million-in-the-second-hack-in-two-months","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain data corroborates the reported exploits. For the April 2022 exploit, Crypto Briefing documented the primary attack transaction hash on Fantom as 0x39825ff84b44d9c9983b4cff464d4746d1ae5432977b9a65a92ab47edac9c9b5, verifiable on FTMScan. In both the March and April 2022 exploits, the attacker's initial capital was withdrawn from Tornado Cash and bridged to Fantom via the Multichain bridge. Post-exploit proceeds were returned to Ethereum and laundered again through Tornado Cash, a mixing protocol that obfuscates transaction trails. The use of Tornado Cash in both 2022 incidents is consistent with behavior documented in numerous DeFi exploits and suggests a sophisticated actor. For the May 2023 exploit, the attack was detected by blockchain security firm PeckShield. The exploit targeted DEI token contracts on Arbitrum, BNB Smart Chain, and Ethereum. Recovered funds from the white-hat operation were placed in a 2/3 multisig wallet controlled by DEUS Finance core contributor @lafachief and members of Yearn Finance, though independent on-chain verification of this multisig address was not confirmed in available public reporting.","heading":"On-Chain Evidence","sources":[{"url":"https://cryptobriefing.com/defi-hacker-steals-13-4m-deus-finance-attack/","name":"","type":"other","credibility":3},{"url":"https://www.bankinfosecurity.com/defi-platform-deus-suffers-second-exploit-in-2-months-a-18988","name":"","type":"other","credibility":3},{"url":"https://quillaudits.medium.com/decoding-deus-dao-6-5-million-exploit-quillaudits-588bbecec61f","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Following each exploit, the DEUS Finance team issued public statements and took remediation steps, though the adequacy of these efforts is disputed given the recurrence of major incidents.\n\nAfter the March 2022 exploit, core developer Lafayette Tabor publicly pledged reimbursement of affected users via a smart contract funded from personal and DEUS DAO reserves. He stated the team had deactivated all affected contracts and was coordinating with the Muon network to upgrade oracle implementations.\n\nAfter the April 2022 exploit, DEUS stated the loss fell on the protocol rather than individual users, and that no user funds had been directly liquidated. The team paused DEI lending as a precautionary measure.\n\nFollowing the May 2023 exploit, DEUS Finance paused all contracts and reportedly burned DEI tokens to limit further damage. The team stated it would release a comprehensive recovery and redemption plan after completing balance snapshots. A white-hat operation allegedly recovered approximately 5.5 million out of 7 million DEI-equivalent tokens, which were held in a 2/3 multisig involving Yearn Finance contributors. The DEI stablecoin had depegged sharply, falling as low as $0.20 at the time of reporting.\n\nNo independent third-party confirmation of full user reimbursement across any of the three incidents was found in available reporting. The recurrence of exploits following each remediation round raises questions about the completeness of each security response.","heading":"Recovery Efforts","sources":[{"url":"https://www.coindesk.com/tech/2022/03/15/derivatives-platform-deus-finance-exploited-for-3m-on-fantom-network","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/deus-finance-loses-6m-following-stablecoin-hack","name":"","type":"other","credibility":3},{"url":"https://crypto.news/deus-finance-hacked-over-6m-dei-stablecoin-stolen/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"DEUS Finance presents a critical risk profile based on publicly documented events. The protocol suffered three distinct security exploits in under 14 months, with combined losses exceeding $22 million. The first two incidents (March and April 2022) exploited the same class of oracle manipulation vulnerability, indicating that the initial remediation failed to adequately address the root cause. The third incident (May 2023) involved a separate code logic flaw introduced during a contract upgrade — a burnFrom parameter reversal — representing a different but equally critical vulnerability class.\n\nThe repeated use of Tornado Cash to launder proceeds in the 2022 incidents suggests the attackers were deliberate and experienced, though no attribution has been publicly confirmed. The DEI stablecoin lost its peg severely during the May 2023 incident, trading at approximately $0.20 against its $1 target, creating downstream losses for any users or protocols that had integrated DEI.\n\nCertiK's 2021 audit of the AMM product did not cover the DEI stablecoin contract where the May 2023 bug existed, highlighting a gap in third-party security coverage. The protocol had not demonstrated comprehensive, independently verified security coverage across all deployed contracts at the time of the third exploit.\n\nGiven the pattern of repeated exploits across different vulnerability classes, evidence of stolen funds laundered through Tornado Cash, the DEI stablecoin's persistent depeg, and the absence of confirmed full user reimbursement, DEUS Finance is assessed as an extremely high-risk protocol. Users who interacted with any DEUS Finance contracts after each exploit incident and did not withdraw may have suffered uncompensated losses. The protocol's current operational status and TVL are significantly degraded from pre-exploit levels.","heading":"Risk Assessment","sources":[{"url":"https://www.certik.com/resources/blog/stablecoin-stumble-the-code-bug-led-to-usd6-5-million-loss-on-deus-finance","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2022/04/28/how-deus-finance-was-exploited-for-134m-on-fantom","name":"","type":"other","credibility":3},{"url":"https://cryptopotato.com/deus-finance-exploited-twice-in-two-months-over-13-million-stolen/","name":"","type":"other","credibility":3},{"url":"https://beincrypto.com/deus-finance-dao-hack-13-million-less-than-60-days/","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-03-15","event":"First exploit: Flash loan attack manipulates Muon oracle on Fantom via USDC/DEI pool price data; approximately $3 million stolen (200,000 DAI and 1,101.8 ETH). Funds laundered through Tornado Cash.","source":""},{"date":"2022-03-15","event":"Lafayette Tabor deactivates affected contracts and pledges reimbursement via smart contract funded by personal and DAO reserves.","source":""},{"date":"2022-04-28","event":"Second exploit: A second flash loan oracle manipulation attack on Fantom drains approximately $13.4 million. Attacker borrows $143 million in a flash loan, artificially inflates DEI price, borrows additional capital against inflated collateral. Tx hash: 0x39825ff84b44d9c9983b4cff464d4746d1ae5432977b9a65a92ab47edac9c9b5. Funds bridged to Ethereum and laundered via Tornado Cash.","source":""},{"date":"2022-04-28","event":"DEUS token price drops approximately 16.5% within 24 hours. Team states loss falls on protocol, not individual users; pauses DEI lending.","source":""},{"date":"2023-05-05","event":"Third exploit: A burnFrom parameter reversal bug in the DEI stablecoin contract is exploited across Arbitrum (~$5M), BNB Smart Chain (~$1.3M), and Ethereum (~$135K), totaling approximately $6.38–$6.5 million. DEI depegs to approximately $0.20.","source":""},{"date":"2023-05-07","event":"DEUS Finance announces partial white-hat recovery of approximately 5.5 million out of 7 million DEI-equivalent tokens. Recovered funds placed in a 2/3 multisig managed by @lafachief and Yearn Finance contributors. All affected contracts paused and subsequently destroyed.","source":""}],"sources_used":[{"url":"https://bitcoinist.com/deus-finance-the-next-generation-multi-asset-defi-protocol/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830035919/https://bitcoinist.com/deus-finance-the-next-generation-multi-asset-defi-protocol/","credibility":3,"archive_timestamp":"2026-08-30T03:59:19+00:00"},{"url":"https://defillama.com/protocol/deus-finance","name":"","type":"other","archive_url":"http://web.archive.org/web/20251009141157/https://defillama.com/protocol/deus-finance","credibility":3,"archive_timestamp":"2025-10-09T14:11:57+00:00"},{"url":"https://www.crunchbase.com/person/lafayette-tabor","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.coindesk.com/tech/2022/03/15/derivatives-platform-deus-finance-exploited-for-3m-on-fantom-network","name":"","type":"other","archive_url":"http://web.archive.org/web/20260725170102/https://www.coindesk.com/tech/2022/03/15/derivatives-platform-deus-finance-exploited-for-3m-on-fantom-network","credibility":3,"archive_timestamp":"2026-07-25T17:01:02+00:00"},{"url":"https://www.theblock.co/post/137817/deus-finance-dao-suffers-3-million-flash-loan-attack","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptobriefing.com/deus-finance-suffers-3m-oracle-exploit/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260312071827/https://cryptobriefing.com/deus-finance-suffers-3m-oracle-exploit/","credibility":3,"archive_timestamp":"2026-03-12T07:18:27+00:00"},{"url":"https://www.coindesk.com/tech/2022/04/28/how-deus-finance-was-exploited-for-134m-on-fantom","name":"","type":"other","archive_url":"http://web.archive.org/web/20260724162251/https://www.coindesk.com/tech/2022/04/28/how-deus-finance-was-exploited-for-134m-on-fantom","credibility":3,"archive_timestamp":"2026-07-24T16:22:51+00:00"},{"url":"https://www.theblock.co/linked/143969/deus-finance-flash-loan-exploit-nets-hacker-13-million","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptobriefing.com/defi-hacker-steals-13-4m-deus-finance-attack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260123053357/https://cryptobriefing.com/defi-hacker-steals-13-4m-deus-finance-attack/","credibility":3,"archive_timestamp":"2026-01-23T05:33:57+00:00"},{"url":"https://therecord.media/more-than-13-million-stolen-from-defi-platform-deus-finance","name":"","type":"other","archive_url":"http://web.archive.org/web/20260520172208/https://therecord.media/more-than-13-million-stolen-from-defi-platform-deus-finance","credibility":3,"archive_timestamp":"2026-05-20T17:22:08+00:00"},{"url":"https://www.certik.com/resources/blog/stablecoin-stumble-the-code-bug-led-to-usd6-5-million-loss-on-deus-finance","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830045404/https://www.certik.com/blog/stablecoin-stumble-the-code-bug-led-to-usd6-5-million-loss-on-deus-finance","credibility":3,"archive_timestamp":"2026-08-30T04:54:04+00:00"},{"url":"https://crypto.news/deus-finance-hacked-over-6m-dei-stablecoin-stolen/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829182847/https://crypto.news/deus-finance-hacked-over-6m-dei-stablecoin-stolen/","credibility":3,"archive_timestamp":"2026-08-29T18:28:47+00:00"},{"url":"https://www.web3isgoinggreat.com/single/deus-finance-exploited-for-13-4-million-in-the-second-hack-in-two-months","name":"","type":"other","archive_url":"http://web.archive.org/web/20260513062721/https://www.web3isgoinggreat.com/single/deus-finance-exploited-for-13-4-million-in-the-second-hack-in-two-months","credibility":3,"archive_timestamp":"2026-05-13T06:27:21+00:00"},{"url":"https://www.bankinfosecurity.com/defi-platform-deus-suffers-second-exploit-in-2-months-a-18988","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830044431/https://www.bankinfosecurity.com/defi-platform-deus-suffers-second-exploit-in-2-months-a-18988","credibility":3,"archive_timestamp":"2026-08-30T04:44:31+00:00"},{"url":"https://quillaudits.medium.com/decoding-deus-dao-6-5-million-exploit-quillaudits-588bbecec61f","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/deus-finance-loses-6m-following-stablecoin-hack","name":"","type":"other","archive_url":"http://web.archive.org/web/20251210095459/https://cointelegraph.com/news/deus-finance-loses-6m-following-stablecoin-hack","credibility":3,"archive_timestamp":"2025-12-10T09:54:59+00:00"},{"url":"https://cryptopotato.com/deus-finance-exploited-twice-in-two-months-over-13-million-stolen/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260422174322/https://cryptopotato.com/deus-finance-exploited-twice-in-two-months-over-13-million-stolen/","credibility":3,"archive_timestamp":"2026-04-22T17:43:22+00:00"},{"url":"https://beincrypto.com/deus-finance-dao-hack-13-million-less-than-60-days/","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:49.914443+00:00","updated_at":"2026-08-30T05:14:13.529396+00:00"}}