{"investigation":{"slug":"rhea-lend","entity_name":"Rhea Lend","trust_score":20,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Rhea Lend is the lending arm of Rhea Finance, a DeFi protocol on NEAR Protocol formed in early 2025 through the merger of Ref Finance and Burrow Finance. In April 2026, Rhea Lend suffered a major exploit in which an attacker drained approximately $18.4 million by exploiting a flaw in the protocol's slippage protection mechanism via a fake-token pool manipulation scheme. Partial recovery of approximately $9–13 million was achieved through voluntary returns and asset freezes, but the incident represents a critical security failure on an audited protocol.","sections":[{"content":"Rhea Finance was formed in early 2025 through a merger of two established NEAR Protocol DeFi protocols: Ref Finance (a leading decentralized exchange) and Burrow Finance (a lending protocol). The merger was publicly announced in March 2025. The combined entity describes itself as a 'unified liquidity hub' offering DEX and lending services with a focus on cross-chain abstraction, targeting Bitcoin, NEAR, and EVM-compatible ecosystems.\n\nThe native tokens of the predecessor protocols — $REF and $BRRR — were consolidated into a single token, $RHEA. The lending component, Rhea Lend (previously Burrow Finance), operates as a non-custodial, pool-based interest rate market where users supply assets to earn yield and borrow against collateral.\n\nAs of Q2 2026, Rhea Finance's total value locked (TVL) stands at approximately $120.96 million, placing it as the dominant DeFi protocol on NEAR. Its market capitalization for the $RHEA token is approximately $2.02 million with a token price near $0.01.","heading":"Background","sources":[{"url":"https://iq.wiki/wiki/rhea-finance","name":"","type":"other","credibility":3},{"url":"https://learnnear.club/introducing-rhea-finance/","name":"","type":"other","credibility":3},{"url":"https://www.near.org/blog/rhea-finance-debuts-rhea-token-unifying-nea-rs-leading-de-fi-protocols-with-chain-abstracted-liquidity","name":"","type":"other","credibility":3},{"url":"https://defillama.com/protocol/rhea-finance","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Rhea Lend functions as a money market protocol on NEAR Protocol. Users deposit supported assets into liquidity pools to earn variable interest rates; borrowers draw against posted collateral, subject to loan-to-value (LTV) ratios and liquidation thresholds. The protocol also features a margin trading function that allows leveraged positions by borrowing against collateral within the same system — this feature was the attack surface exploited in April 2026.\n\nRhea Finance's broader architecture includes a DEX component (Rhea Dex, formerly Ref Finance) and, per its roadmap, planned expansions into multi-chain lending across NEAR, EVM, and Solana, as well as AI-powered cross-chain yield vaults. The $RHEA token is used for governance and, via its staked form xRHEA, as collateral and for gas fee payment.\n\nThe protocol reported cumulative DEX volume exceeding $20.449 billion and active loans of approximately $30.48 million as of Q2 2026.","heading":"Protocol Mechanics","sources":[{"url":"https://guide.rhea.finance/docs/rhea-finance-white-paper","name":"","type":"other","credibility":3},{"url":"https://defillama.com/protocol/rhea-finance","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Rhea Finance commissioned multiple pre-exploit security audits from reputable firms:\n\n- **Trail of Bits** (February 19, 2025): Audited smart contracts for the Ref Finance DeFi protocol.\n- **BlockSec** (April 2, 2025): Audited the Burrow Margin Trading module specifically.\n- **BlockSec** (August 5, 2025): Audited the rNEAR Contract.\n- **Resonance Security** (October 9, 2025): Audited the Liquid Staking Protocol.\n\nThe protocol also maintained a bug bounty program through Immunefi and listed Slowmist as a security partner. Specific findings from these audits have not been made public in searchable form.\n\n**April 2026 Exploit — $18.4 Million Loss**\n\nDespite these audits, on April 16, 2026, an attacker drained approximately $18.4 million from Rhea Lend via a sophisticated slippage-protection bypass. Initial estimates placed losses at $7.6 million; the figure was revised to $18.4 million in the official post-mortem.\n\nThe attacker spent at least two days (April 13–15) preparing infrastructure: creating a primary wallet, 423 intermediary wallets, fake ERC-20-style token contracts, and eight trading pools on Ref Finance with manipulated price ratios.\n\nThe core exploit targeted a flaw in the multi-step slippage aggregation logic. The protocol's slippage check summed expected output values across sequential swap steps without detecting that the same attacker-controlled token was used as both output in one step and input in the next. This allowed the attacker to construct a circular swap path — converting 1,000 USDC to 999 AttackerToken, then 999 AttackerToken back to 1 USDC — in which the slippage check returned a passing result (999+1=1,000) while only 1 USDC was returned and 999 USDC remained in the attacker's fake pools. Borrowed funds were thus diverted into attacker-controlled pools, triggering forced liquidations that drained the protocol's reserve pool. The vulnerability was identified by Halborn and covered by The Block in a post-mortem analysis.\n\nThe BlockSec audit of the Margin Trading module conducted in April 2025 predated the deployed version in which this vulnerability existed, or the flaw was introduced or went undetected in a post-audit code change.\n\n**Recovery Status**\n\nPartial recovery occurred through a combination of voluntary returns and coordinated asset freezes:\n- $3.359 million USDC returned to the Rhea Lend contract by the attacker\n- $1.564 million NEAR returned to the Rhea Lend contract by the attacker\n- $3.291 million USDT frozen by Tether (Paolo Ardoino confirmed this publicly)\n- $1.053 million USDT frozen in NEAR Intents\n- Additional community-reported on-chain evidence suggests ~$3.49 million in AAVE USDC V3 tokens transferred on Ethereum and ~13,500 ZEC (~$4.44 million) recovered on Zcash\n\nTotal recovered or frozen: approximately $9–13 million. Unaccounted shortfall: approximately $5.4–9.4 million depending on the recovery figure used. The Near Intents team stated the attacker may be identifiable and has a public presence on social media; centralized exchanges were notified to assist in tracing account ownership. As of May 2026, a compensation and recovery framework was stated to be in development but no specifics had been disclosed.","heading":"Security & Audits","sources":[{"url":"https://guide.rhea.finance/developers/audits","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-rhea-finance-hack-april-2026","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/397961/rhea-finance-post-mortem-exploit-losses-18-4-million-double-initial-estimates","name":"","type":"other","credibility":3},{"url":"https://coinedition.com/18-4m-rhea-finance-hack-built-over-two-days-post-mortem-reveals/","name":"","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/04/18/hacker-returns-all-the-funds-to-rhea-finance-fact-check/","name":"","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/04/16/rhea-finance-loses-7-6m-in-exploit-says-certik/","name":"","type":"other","credibility":3},{"url":"https://phemex.com/news/article/rhea-finance-suffers-184-million-exploit-due-to-slippage-protection-flaw-74100","name":"","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/single/rhea-finance-exploit","name":"","type":"other","credibility":3},{"url":"https://ambcrypto.com/rhea-finance-revises-exploit-losses-to-18-4m-confirms-slippage-flaw-as-funds-partially-recovered/","name":"","type":"other","credibility":3},{"url":"https://www.mexc.com/news/1036012","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Rhea Finance has not publicly disclosed its core team members in detail in available documentation. NEAR Protocol co-founder Illia Polosukhin was noted to have been involved in the founding of the predecessor Ref Finance, though his current involvement with Rhea Finance is not established in available sources.\n\nThe protocol is described as a decentralized, community-governed entity, with $RHEA token holders participating in governance decisions. However, the degree of decentralization of operational and upgrade controls is not independently verifiable from public sources.\n\nNo regulatory actions, sanctions, or law enforcement investigations involving Rhea Finance's team have been identified in available sources as of May 2026.","heading":"Team & Ownership","sources":[{"url":"https://iq.wiki/wiki/rhea-finance","name":"","type":"other","credibility":3},{"url":"https://learnnear.club/introducing-rhea-finance/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Rhea Lend presents significant risk to users across multiple dimensions:\n\n**Proven Smart Contract Vulnerability (Critical):** The April 2026 exploit demonstrated a fundamental flaw in the multi-step slippage aggregation logic of the margin trading feature. The attack resulted in $18.4 million in losses on an audited protocol, with the vulnerable code having passed a BlockSec audit of the Margin Trading module in April 2025. This indicates that either the audit failed to catch the vulnerability, or it was introduced in subsequent code changes without re-audit.\n\n**Incomplete Recovery (High):** Despite partial fund recovery through the attacker's voluntary returns and Tether's asset freeze, an estimated $5.4–9.4 million remains unaccounted for. No final compensation mechanism had been announced as of May 2026.\n\n**Oracle Design Weakness (High):** The Halborn post-mortem noted the protocol's oracle relied on recent data without historical context, allowing attackers to bootstrap fake price histories for worthless tokens with minimal effort. This is a known and well-documented class of vulnerability in DeFi.\n\n**Concentration Risk (Medium):** As the dominant protocol in NEAR's DeFi ecosystem (holding the vast majority of NEAR's TVL), any further exploits or protocol failures would have outsized ecosystem-wide consequences. TVL dropped notably post-exploit.\n\n**Token Price Risk (Medium):** The $RHEA token price declined approximately 8% in the immediate aftermath of the exploit. Market capitalization of approximately $2 million is low relative to TVL, indicating limited token market depth.\n\n**Team Opacity (Low-Medium):** Core team members are not publicly identified in protocol documentation, limiting accountability and independent assessment of development practices.\n\nUsers considering interaction with Rhea Lend should be aware that the protocol suffered a critical exploit as recently as April 2026 and that recovery efforts remain ongoing. Audits did not prevent the incident. Risk should be assessed against any compensation commitments made by the protocol before depositing funds.","heading":"Risk Assessment","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-rhea-finance-hack-april-2026","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/397961/rhea-finance-post-mortem-exploit-losses-18-4-million-double-initial-estimates","name":"","type":"other","credibility":3},{"url":"https://www.ccn.com/education/crypto/defi-hacks-2026-137m-lost-step-finance-truebit-resolv-exploits/","name":"","type":"other","credibility":3},{"url":"https://www.coingabbar.com/en/crypto-currency-news/rhea-finance-crypto-hack-update-near-defi-rhea-token-price-drop","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2025-02","event":"Ref Finance and Burrow Finance announce merger to form Rhea Finance on NEAR Protocol","source":"","date_original":"2025-02-01"},{"date":"2025-02-19","event":"Trail of Bits completes smart contract audit of Ref Finance DeFi protocol","source":""},{"date":"2025-03","event":"Rhea Finance merger formally announced; $RHEA token introduced as unified governance token","source":"","date_original":"2025-03-01"},{"date":"2025-04-02","event":"BlockSec completes audit of Burrow Margin Trading module","source":""},{"date":"2025-08-05","event":"BlockSec completes audit of rNEAR Contract","source":""},{"date":"2025-10-09","event":"Resonance Security completes audit of Liquid Staking Protocol","source":""},{"date":"2026-04-13","event":"Attacker begins two-day preparation: creates 423 intermediary wallets and eight fake token pools on Ref Finance","source":""},{"date":"2026-04-16","event":"Exploit executed: attacker exploits slippage protection flaw in margin trading, draining approximately $7.6 million (initial estimate) from Rhea Lend; CertiK flags the incident; RHEA token price drops approximately 8%","source":""},{"date":"2026-04-17","event":"Additional on-chain activity observed: ~$3.49 million in AAVE USDC V3 tokens moved on Ethereum; attacker returns $3.359 million USDC and $1.564 million NEAR to Rhea Lend contract","source":""},{"date":"2026-04-18","event":"Post-mortem published revising total losses to $18.4 million; Tether freezes $3.291 million USDT in attacker wallet; NEAR Intents freezes additional $1.053 million USDT; Halborn and The Block publish detailed exploit analyses","source":""},{"date":"2026-04-18","event":"Near Intents team states attacker may be identifiable with public social media presence; centralized exchanges notified to assist tracing","source":""},{"date":"2026-05-19","event":"Protocol TVL stands at approximately $120.96 million; compensation framework described as 'in development' with no specifics disclosed; estimated $5.4–9.4 million in losses remain unaccounted for","source":""}],"sources_used":[{"url":"https://iq.wiki/wiki/rhea-finance","name":"","type":"other","archive_url":"http://web.archive.org/web/20260120001815/https://iq.wiki/wiki/rhea-finance","credibility":3,"archive_timestamp":"2026-01-20T00:18:15+00:00"},{"url":"https://learnnear.club/introducing-rhea-finance/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251214045520/https://learnnear.club/introducing-rhea-finance/","credibility":3,"archive_timestamp":"2025-12-14T04:55:20+00:00"},{"url":"https://www.near.org/blog/rhea-finance-debuts-rhea-token-unifying-nea-rs-leading-de-fi-protocols-with-chain-abstracted-liquidity","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829051402/https://www.near.org/blog/rhea-finance-debuts-rhea-token-unifying-nea-rs-leading-de-fi-protocols-with-chain-abstracted-liquidity","credibility":3,"archive_timestamp":"2026-08-29T05:14:02+00:00"},{"url":"https://defillama.com/protocol/rhea-finance","name":"","type":"other","archive_url":"http://web.archive.org/web/20250910073442/https://defillama.com/protocol/rhea-finance","credibility":3,"archive_timestamp":"2025-09-10T07:34:42+00:00"},{"url":"https://guide.rhea.finance/docs/rhea-finance-white-paper","name":"","type":"other","archive_url":"http://web.archive.org/web/20260609201617/https://guide.rhea.finance/docs/rhea-finance-white-paper","credibility":3,"archive_timestamp":"2026-06-09T20:16:17+00:00"},{"url":"https://guide.rhea.finance/developers/audits","name":"","type":"other","archive_url":"http://web.archive.org/web/20260518122657/https://guide.rhea.finance/developers/audits","credibility":3,"archive_timestamp":"2026-05-18T12:26:57+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-rhea-finance-hack-april-2026","name":"","type":"other","archive_url":"http://web.archive.org/web/20260520123847/https://www.halborn.com/blog/post/explained-the-rhea-finance-hack-april-2026","credibility":3,"archive_timestamp":"2026-05-20T12:38:47+00:00"},{"url":"https://www.theblock.co/post/397961/rhea-finance-post-mortem-exploit-losses-18-4-million-double-initial-estimates","name":"","type":"other","archive_url":"http://web.archive.org/web/20260728063803/https://www.theblock.co/post/397961/rhea-finance-post-mortem-exploit-losses-18-4-million-double-initial-estimates","credibility":3,"archive_timestamp":"2026-07-28T06:38:03+00:00"},{"url":"https://coinedition.com/18-4m-rhea-finance-hack-built-over-two-days-post-mortem-reveals/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260726083008/https://coinedition.com/18-4m-rhea-finance-hack-built-over-two-days-post-mortem-reveals/","credibility":3,"archive_timestamp":"2026-07-26T08:30:08+00:00"},{"url":"https://www.cryptotimes.io/2026/04/18/hacker-returns-all-the-funds-to-rhea-finance-fact-check/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260726102316/https://www.cryptotimes.io/2026/04/18/hacker-returns-all-the-funds-to-rhea-finance-fact-check/","credibility":3,"archive_timestamp":"2026-07-26T10:23:16+00:00"},{"url":"https://www.cryptotimes.io/2026/04/16/rhea-finance-loses-7-6m-in-exploit-says-certik/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260726153326/https://www.cryptotimes.io/2026/04/16/rhea-finance-loses-7-6m-in-exploit-says-certik/","credibility":3,"archive_timestamp":"2026-07-26T15:33:26+00:00"},{"url":"https://phemex.com/news/article/rhea-finance-suffers-184-million-exploit-due-to-slippage-protection-flaw-74100","name":"","type":"other","archive_url":"http://web.archive.org/web/20260727003233/https://phemex.com/news/article/rhea-finance-suffers-184-million-exploit-due-to-slippage-protection-flaw-74100","credibility":3,"archive_timestamp":"2026-07-27T00:32:33+00:00"},{"url":"https://www.web3isgoinggreat.com/single/rhea-finance-exploit","name":"","type":"other","archive_url":"http://web.archive.org/web/20260708045759/https://www.web3isgoinggreat.com/single/rhea-finance-exploit","credibility":3,"archive_timestamp":"2026-07-08T04:57:59+00:00"},{"url":"https://ambcrypto.com/rhea-finance-revises-exploit-losses-to-18-4m-confirms-slippage-flaw-as-funds-partially-recovered/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260419032931/https://ambcrypto.com/rhea-finance-revises-exploit-losses-to-18-4m-confirms-slippage-flaw-as-funds-partially-recovered/","credibility":3,"archive_timestamp":"2026-04-19T03:29:31+00:00"},{"url":"https://www.mexc.com/news/1036012","name":"","type":"other","archive_url":"http://web.archive.org/web/20260418064338/https://www.mexc.com/news/1036012","credibility":3,"archive_timestamp":"2026-04-18T06:43:38+00:00"},{"url":"https://www.ccn.com/education/crypto/defi-hacks-2026-137m-lost-step-finance-truebit-resolv-exploits/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260327052525/https://www.ccn.com/education/crypto/defi-hacks-2026-137m-lost-step-finance-truebit-resolv-exploits/","credibility":3,"archive_timestamp":"2026-03-27T05:25:25+00:00"},{"url":"https://www.coingabbar.com/en/crypto-currency-news/rhea-finance-crypto-hack-update-near-defi-rhea-token-price-drop","name":"","type":"other","archive_url":"http://web.archive.org/web/20260829045406/https://www.coingabbar.com/en/crypto-currency-news/rhea-finance-crypto-hack-update-near-defi-rhea-token-price-drop","credibility":3,"archive_timestamp":"2026-08-29T04:54:06+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:11.905007+00:00","updated_at":"2026-08-29T09:20:59.18296+00:00"}}