{"investigation":{"slug":"raft","entity_name":"Raft","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Raft is a decentralized Ethereum CDP lending protocol that issued the R stablecoin, collateralized by liquid staking tokens (stETH, rETH). On November 10, 2023, an attacker exploited a precision loss vulnerability to mint approximately $6.7 million in unbacked R tokens, draining 1,577 ETH from the protocol and causing the R stablecoin to depeg by up to 50%. Due to a coding error the attacker burned 1,570 of the stolen ETH to an inaccessible burn address, effectively losing money on the attack; the protocol subsequently implemented a partial recovery plan offering approximately 42% restitution to affected users and announced plans to phase out the current version.","sections":[{"content":"Raft is an immutable, decentralized finance (DeFi) lending protocol built on Ethereum, designed to allow users to borrow the R stablecoin by depositing liquid staking tokens (LSTs) such as Lido's stETH, Rocket Pool's rETH, and Coinbase's cbETH as collateral. The protocol uses a Collateralized Debt Position (CDP) model requiring a minimum 110% collateralization ratio and charged zero borrowing fees, positioning itself as a capital-efficient stablecoin. The R stablecoin maintains its $1 peg through a combination of hard and soft peg mechanisms backed by arbitrage and a Peg Stability Module (PSM) funded with sDAI and CHAI. The protocol was developed by Tempus Labs, whose founder David Garai had previously established Tempus Finance and Nostra Finance on StarkNet. Notable investors included market-making firms Wintermute and GSR. Total value locked (TVL) peaked at approximately $64 million in July 2023 before declining sharply following the November 2023 security incident; by early 2026 TVL had fallen to approximately $17,000.","heading":"Protocol Overview","sources":[{"url":"https://iq.wiki/wiki/raft","name":"iq.wiki","type":"other","credibility":3},{"url":"https://defillama.com/protocol/raft","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.gate.com/learn/articles/all-you-need-to-know-about-raft/1113","name":"gate.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 10, 2023, Raft suffered a critical security exploit in which an attacker used a flash loan to borrow 6,000 Coinbase-wrapped staked Ether (cbETH) from AAVE and leveraged a precision loss vulnerability in the protocol's share-token minting logic to generate approximately 6.7 million unbacked R tokens. The root cause was a rounding-up (divUp) function in the minting process that allowed the attacker to obtain one extra share token per transaction even when depositing a negligible (1 wei) amount of collateral. By artificially inflating the collateral index rate and repeating this process 60 times, the attacker accumulated 60 wei shares equivalent to roughly 10,050 cbETH in value. The attacker then swapped the unbacked R tokens into approximately 1,577 ETH by draining automated market maker liquidity pools, simultaneously withdrawing collateral from the protocol. The on-chain exploit transaction is recorded at Ethereum transaction hash 0xfeedbf51b4e2338e38171f6e19501327294ab1907ab44cfd2d7e7336c975ace7. The total value at risk in the protocol (collateral that could have been drained) has been reported as $6.7 million, while the actual net ETH extracted was 1,577 ETH (approximately $3.3 million at time of exploit). A coding error in the attacker's script caused 1,570 of the stolen ETH (approximately $3.25 million) to be irreversibly sent to a burn address (0x0000...dead), permanently destroying those funds. After accounting for the ETH spent to fund the attack, the perpetrator's net outcome was an estimated loss of approximately 4 ETH (~$8,000). The R stablecoin depegged sharply following the attack, falling as low as $0.11 to $0.70 in various reports immediately after the incident before partial recovery.","heading":"November 2023 Exploit","sources":[{"url":"https://www.coindesk.com/tech/2023/11/10/defi-platform-raft-suffers-33m-exploit-but-hacker-likely-takes-a-loss-on-the-attack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cryptodaily.co.uk/2023/11/security-audits-miss-vulnerabilities-as-raft-hacked-for-67m","name":"cryptodaily.co.uk","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=raft-hack","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2023/11/11/hacker-exploits-raft-finance-stole-1577-eth-just-to-burn-it/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://metatrust.io/blogs/post/when-hacking-goes-haywire-rafts-1570-eth-loss-takes-a-cosmic-detour-to-the-black-hole","name":"metatrust.io","type":"other","credibility":3}],"severity":"medium"},{"content":"At the time of the exploit, the Raft protocol's smart contracts had undergone multiple security audits. Known auditors included Trail of Bits, Hats Finance (which ran a community audit competition with up to $80,000 in prizes and reviewed 61 submissions of which 19 qualified for rewards), Curious Apple, and Aviggiano. None of these audits identified the precision loss vulnerability in the cbETH InterestRatePositionManager contract that was ultimately exploited. The failure of multiple independent audit firms to detect the vulnerability was widely cited in DeFi security coverage as evidence that audits cannot guarantee the absence of vulnerabilities. The Raft post-mortem published on November 13, 2023 acknowledged the audit oversight.","heading":"Security Audit Failures","sources":[{"url":"https://cryptodaily.co.uk/2023/11/security-audits-miss-vulnerabilities-as-raft-hacked-for-67m","name":"cryptodaily.co.uk","type":"other","credibility":3},{"url":"https://blockworks.co/news/audits-cannot-guarantee-defi-exploits","name":"blockworks.co","type":"other","credibility":3},{"url":"https://hatsfinance.medium.com/raft-finance-audit-competition-final-note-16e87dce23a2","name":"hatsfinance.medium.com","type":"other","credibility":3},{"url":"https://hatsfinance.medium.com/get-ready-for-a-new-audit-competition-with-raft-finance-up-to-80k-in-prizes-d25349aec7e5","name":"hatsfinance.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, Raft co-founder David Garai confirmed the attack on X (formerly Twitter) and immediately paused the minting of new R tokens. The team stated they were working with law enforcement, centralized exchanges, and other parties to identify the attacker. Garai publicly stated: 'We are trying to make people whole using the protocol-owned sDAI in the Peg Stability Module.' A recovery plan was developed and finalized with community feedback, ultimately offering affected users approximately 42% recovery on their losses, funded by 3.96 million DAI held in the protocol's PSM. The deadline for victims to participate in the recovery plan was set at the end of March 2024. The team also announced that the current version of Raft would be phased out and that Raft DAO would focus on launching a new, more secure version in the future.","heading":"Team Response and Recovery Plan","sources":[{"url":"https://www.coindesk.com/tech/2023/11/10/defi-platform-raft-suffers-33m-exploit-but-hacker-likely-takes-a-loss-on-the-attack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.chaincatcher.com/en/article/2105941","name":"chaincatcher.com","type":"other","credibility":3},{"url":"https://www.theblockbeats.info/en/flash/194388","name":"theblockbeats.info","type":"other","credibility":3},{"url":"https://www.aicoin.com/en/article/374606","name":"aicoin.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the November 2023 exploit, the Raft protocol experienced a severe and sustained decline in total value locked. TVL had peaked at approximately $64 million in July 2023. By early 2024 it had fallen to $1.48 million, and by early 2026 DefiLlama reported the protocol's TVL at approximately $17,000 — a decline of over 99.97% from peak. The R stablecoin remained volatile with very limited liquidity on a small number of decentralized exchange markets. The protocol has not publicly announced a full wind-down but has effectively become inactive based on on-chain data and TVL metrics. No regulatory actions by the SEC, CFTC, or other government bodies have been publicly reported in connection with Raft.","heading":"Protocol Status and TVL Decline","sources":[{"url":"https://defillama.com/protocol/raft","name":"defillama.com","type":"other","credibility":3},{"url":"https://blockworks.co/news/audits-cannot-guarantee-defi-exploits","name":"blockworks.co","type":"other","credibility":3}],"severity":"medium"},{"content":"Raft was built by Tempus Labs. David Garai, the founder, holds a law degree from the University of Manchester and previously worked as a structured finance lawyer in London and Tokyo before founding Tempus Finance in May 2021 and later launching Nostra Finance on StarkNet in August 2022. Co-founder Djordje Mijovic served as technical lead and previously worked as a core Solidity compiler developer at the Ethereum Foundation. Other team members included a former debt finance lawyer and a researcher with over 15 years of experience in hedge funds and investment banks. No allegations of intentional fraud or insider misconduct by team members have been publicly substantiated.","heading":"Team Background","sources":[{"url":"https://www.rootdata.com/Projects/detail/Raft?k=ODE1MA%3D%3D","name":"rootdata.com","type":"other","credibility":3},{"url":"https://www.gate.com/learn/articles/all-you-need-to-know-about-raft/1113","name":"gate.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-05","event":"David Garai founds Tempus Finance, the parent organization behind Raft.","source":"","date_original":"2021-05-01"},{"date":"2022-08","event":"Tempus Labs launches Nostra Finance on StarkNet.","source":"","date_original":"2022-08-01"},{"date":"2023-03","event":"Raft protocol officially announced; enables borrowing of R stablecoin against stETH collateral on Ethereum mainnet.","source":"","date_original":"2023-03-01"},{"date":"2023-06","event":"Raft deploys to Ethereum mainnet.","source":"","date_original":"2023-06-01"},{"date":"2023-07","event":"Raft TVL peaks at approximately $64 million.","source":"","date_original":"2023-07-01"},{"date":"2023-11-10","event":"Attacker uses flash loan of 6,000 cbETH to exploit precision loss vulnerability, minting ~6.7 million unbacked R tokens and draining 1,577 ETH (~$3.3M). Attacker burns 1,570 ETH by mistake. R stablecoin depegs by up to 50%.","source":""},{"date":"2023-11-10","event":"Raft pauses R stablecoin minting. Co-founder David Garai confirms the attack on X and pledges recovery effort using PSM funds.","source":""},{"date":"2023-11-13","event":"Raft publishes post-mortem report acknowledging audit failures and precision loss root cause.","source":""},{"date":"2024","event":"Raft finalizes recovery plan offering approximately 42% restitution to affected R stablecoin holders, funded by 3.96 million DAI from the PSM.","source":"","date_original":"2024-01-01"},{"date":"2024-03-31","event":"Deadline for affected users to claim funds under the Raft Recovery Plan.","source":""},{"date":"2024-06","event":"Protocol TVL has declined to approximately $1.48 million; R stablecoin remains depegged with minimal liquidity.","source":"","date_original":"2024-06-01"}],"sources_used":[{"url":"https://iq.wiki/wiki/raft","name":"iq.wiki","type":"other","archive_url":"http://web.archive.org/web/20260613063227/https://iq.wiki/wiki/raft","credibility":3,"archive_timestamp":"2026-06-13T06:32:27+00:00"},{"url":"https://defillama.com/protocol/raft","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250917000023/https://defillama.com/protocol/raft","credibility":3,"archive_timestamp":"2025-09-17T00:00:23+00:00"},{"url":"https://www.gate.com/learn/articles/all-you-need-to-know-about-raft/1113","name":"gate.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.coindesk.com/tech/2023/11/10/defi-platform-raft-suffers-33m-exploit-but-hacker-likely-takes-a-loss-on-the-attack","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260427094649/https://www.coindesk.com/tech/2023/11/10/defi-platform-raft-suffers-33m-exploit-but-hacker-likely-takes-a-loss-on-the-attack","credibility":3,"archive_timestamp":"2026-04-27T09:46:49+00:00"},{"url":"https://cryptodaily.co.uk/2023/11/security-audits-miss-vulnerabilities-as-raft-hacked-for-67m","name":"cryptodaily.co.uk","type":"other","archive_url":"http://web.archive.org/web/20260727043211/https://cryptodaily.co.uk/2023/11/security-audits-miss-vulnerabilities-as-raft-hacked-for-67m","credibility":3,"archive_timestamp":"2026-07-27T04:32:11+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=raft-hack","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260612081230/https://www.web3isgoinggreat.com/?id=raft-hack","credibility":3,"archive_timestamp":"2026-06-12T08:12:30+00:00"},{"url":"https://www.cryptotimes.io/2023/11/11/hacker-exploits-raft-finance-stole-1577-eth-just-to-burn-it/","name":"cryptotimes.io","type":"other","archive_url":"http://web.archive.org/web/20251202120234/https://www.cryptotimes.io/2023/11/11/hacker-exploits-raft-finance-stole-1577-eth-just-to-burn-it/","credibility":3,"archive_timestamp":"2025-12-02T12:02:34+00:00"},{"url":"https://metatrust.io/blogs/post/when-hacking-goes-haywire-rafts-1570-eth-loss-takes-a-cosmic-detour-to-the-black-hole","name":"metatrust.io","type":"other","archive_url":"http://web.archive.org/web/20260419044059/https://www.metatrust.io/blogs/post/when-hacking-goes-haywire-rafts-1570-eth-loss-takes-a-cosmic-detour-to-the-black-hole","credibility":3,"archive_timestamp":"2026-04-19T04:40:59+00:00"},{"url":"https://blockworks.co/news/audits-cannot-guarantee-defi-exploits","name":"blockworks.co","type":"other","archive_url":"http://web.archive.org/web/20260301075738/https://blockworks.co/news/audits-cannot-guarantee-defi-exploits","credibility":3,"archive_timestamp":"2026-03-01T07:57:38+00:00"},{"url":"https://hatsfinance.medium.com/raft-finance-audit-competition-final-note-16e87dce23a2","name":"hatsfinance.medium.com","type":"other","archive_url":"http://web.archive.org/web/20260725180651/https://hatsfinance.medium.com/raft-finance-audit-competition-final-note-16e87dce23a2","credibility":3,"archive_timestamp":"2026-07-25T18:06:51+00:00"},{"url":"https://hatsfinance.medium.com/get-ready-for-a-new-audit-competition-with-raft-finance-up-to-80k-in-prizes-d25349aec7e5","name":"hatsfinance.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.chaincatcher.com/en/article/2105941","name":"chaincatcher.com","type":"other","archive_url":"https://web.archive.org/web/20260829145320/https://www.chaincatcher.com/en/article/2105941","credibility":3,"archive_timestamp":"2026-08-29T14:53:20+00:00"},{"url":"https://www.theblockbeats.info/en/flash/194388","name":"theblockbeats.info","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.aicoin.com/en/article/374606","name":"aicoin.com","type":"other","archive_url":"https://web.archive.org/web/20260830003207/https://www.aicoin.com/en/article/374606","credibility":3,"archive_timestamp":"2026-08-30T00:32:07+00:00"},{"url":"https://www.rootdata.com/Projects/detail/Raft?k=ODE1MA%3D%3D","name":"rootdata.com","type":"other","archive_url":"http://web.archive.org/web/20250909124206/https://www.rootdata.com/Projects/detail/Raft?k=ODE1MA%3D%3D","credibility":3,"archive_timestamp":"2025-09-09T12:42:06+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:37.319271+00:00","updated_at":"2026-08-30T05:14:09.236101+00:00"}}