{"investigation":{"slug":"sharwafinance","entity_name":"Sharwa.Finance","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Sharwa.Finance is an on-chain portfolio margin trading protocol deployed on Arbitrum, enabling leveraged spot and options trading with cross-margin collateral. The protocol suffered a $147,000 exploit in October 2025 via a flash loan price-oracle manipulation attack, a vulnerability class that had been explicitly identified and reported by the Pashov Audit Group over one year prior to the incident. The protocol was flagged by on-chain security researchers including ZachXBT-adjacent monitoring networks, and a second oracle manipulation incident resulting in approximately $32,850 in losses was recorded in May 2026.","sections":[{"content":"Sharwa.Finance describes itself as an on-chain portfolio margin trading protocol operating on the Arbitrum Layer 2 network. The protocol allows traders to use any supported asset as collateral to open leveraged positions and trade options within a single unified margin account, described by the team as bringing 'Wall Street-style portfolio margin trading' to decentralized finance. It supports up to 10x leverage by routing trades through Uniswap V3 liquidity pools. Liquidity providers earn fees by supplying assets to the protocol's lending pools. As of late May 2026, the protocol's total value locked (TVL) stood at approximately $3,944, reflecting a near-total collapse in depositor confidence following repeated security incidents. Sharwa.Finance does not have a publicly issued governance or utility token. The protocol's GitHub organization (github.com/SharwaFinance) hosts its smart contract code, and the team maintains a presence on X (formerly Twitter) under @SharwaFinance.","heading":"Protocol Overview","sources":[{"url":"https://defillama.com/protocol/sharwa.finance","name":"defillama.com","type":"other","credibility":3},{"url":"https://sharwa.finance/app.html","name":"sharwa.finance","type":"other","credibility":3}],"severity":"medium"},{"content":"On October 20, 2025 (with additional attack transactions recorded on October 27, 2025), Sharwa.Finance was exploited via a flash loan-assisted price oracle manipulation attack, resulting in losses of approximately $147,000 from its WETH and WBTC liquidity pools. The attack followed a textbook flash loan price-manipulation pattern. The attacker obtained a large USDC flash loan from the Morpho protocol, executed a large swap on a Uniswap V3 WBTC/USDC pool to distort the spot price, then called Sharwa's FacadeTradeRouter contract, which read prices directly from the manipulated pool via the getAmountOut function. Using these artificially inflated valuations, the attacker executed a privileged decreaseLongPosition call, withdrawing significantly more value than their position was actually worth. The attacker then reversed the Uniswap pool manipulation, repaid the flash loan, and retained the difference as profit. Identified attacker addresses include 0xaa24987bab540617416b77c986f66ae009c55795 and 0xd356c82e0c85e1568641d084dbdaf76b8df96c08. The vulnerable contract address is 0xd3fde5af30da1f394d6e0d361b552648d0dff797. A secondary analysis by FailSafe identified that two distinct attackers exploited a related vulnerability — an absence of insolvency checks in the MarginTrading contract's swap function — contributing approximately $61,000 and $85,000 respectively to the total loss figure. Approximately $40,000 of the stolen funds was subsequently recovered. Following the attack, the Sharwa Finance team placed the protocol into Reduce-Only mode, permitting position closures and collateral withdrawals while blocking new positions, and committed to 100% reimbursement of affected users.","heading":"October 2025 Exploit — Flash Loan Oracle Manipulation","sources":[{"url":"https://blog.verichains.io/p/vulnerability-analysis-deconstructing","name":"blog.verichains.io","type":"other","credibility":3},{"url":"https://getfailsafe.com/sharwafinance-exploit-analysis/","name":"getfailsafe.com","type":"other","credibility":3},{"url":"https://quadrigainitiative.com/casestudy/sharwafinancemargintradingsandwichattacksolvencyflaw.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://blockthreat.com/blockthreat-week-43-2025/","name":"blockthreat.com","type":"other","credibility":3},{"url":"https://de.fi/blog/defi-rekt-report-october-2025-38-6-million-lost-across-9-exploits","name":"de.fi","type":"other","credibility":3}],"severity":"medium"},{"content":"The Pashov Audit Group conducted a security review of the SharwaFinance/MarginTrading repository dated June 17, 2024 — more than one year before the October 2025 exploit. The audit identified the exact vulnerability class that enabled the attack as a Critical-severity finding. Critical finding C-01, 'Uniswap Spot Price Manipulation,' explicitly documented that the protocol relies on the Uniswap V3 quoter for token valuations in all critical functions including withdrawal, borrowing, repayment, and liquidation, and that these prices are easily manipulated via flash loans. The audit's recommended remediation was to implement Chainlink oracles for price feeds. The audit identified a total of four critical-severity findings and five high-severity findings, including unauthorized option exercise (C-02), debt shares rounding exploitation (C-03), and NFT array denial-of-service (C-04). High-severity findings included the ability for unhealthy accounts to continue executing swaps during liquidation status. Verichains analysis of the October 2025 exploit noted that the vulnerable FacadeTradeRouter contract was a new deployment created just 18 days before the attack, and that the fix for the known oracle vulnerability had not been applied to the newly deployed contract, nor had the new deployment undergone a re-audit. The Quadriga Initiative case study confirmed the team acknowledged that 'post-audit code modifications weren't re-reviewed due to security review costs.' This pattern — where an audited vulnerability is re-introduced in a new deployment — represents a significant operational security failure.","heading":"Prior Audit Findings and Failure to Remediate","sources":[{"url":"https://github.com/pashov/audits/blob/master/team/md/SharwaFinance-security-review.md","name":"github.com","type":"other","credibility":3},{"url":"https://blog.verichains.io/p/vulnerability-analysis-deconstructing","name":"blog.verichains.io","type":"other","credibility":3},{"url":"https://quadrigainitiative.com/casestudy/sharwafinancemargintradingsandwichattacksolvencyflaw.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"According to DefiLlama protocol data, Sharwa.Finance recorded a second security incident on May 1, 2026, resulting in approximately $32,850 in losses attributed to oracle price manipulation on the Arbitrum network. Specific technical details of this second incident are not yet available in publicly indexed reporting as of the date of this investigation. The recurrence of an oracle-related incident following the October 2025 exploit raises concerns about whether the root cause was fully resolved in the interim. At the time of this second incident, the protocol's TVL was already severely depleted from the earlier attack, suggesting the affected amounts represent a substantial portion of remaining depositor funds. This second breach has not yet been covered by major crypto security outlets and is documented primarily in on-chain analytics dashboards.","heading":"Second Incident — May 2026","sources":[{"url":"https://defillama.com/protocol/sharwa.finance","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The October 2025 Sharwa.Finance exploit was documented and flagged by multiple on-chain security researchers and monitoring services. Blockthreat's Week 43, 2025 security report included the incident in its paid subscriber deep-dive coverage, noting the exploit as a reappearance of a vulnerability previously identified in the Pashov audit. Security accounts including DecurityHQ and Phalcon_xyz were among those that publicly documented the transactions on-chain. The entity is flagged by ZachXBT-associated monitoring networks as a protocol that suffered a preventable exploit due to the failure to implement known security fixes. The October 2025 incident ranked as the seventh-largest DeFi exploit of that month, according to the de.fi DeFi Rekt Report for October 2025, which recorded $38.6 million lost across nine exploits during the period. The Sharwa.Finance team publicly posted an attack post-mortem on X at the handle @SharwaFinance, acknowledging the incident and committing to user reimbursement.","heading":"Security Researcher Attention and Community Response","sources":[{"url":"https://blockthreat.com/blockthreat-week-43-2025/","name":"blockthreat.com","type":"other","credibility":3},{"url":"https://de.fi/blog/defi-rekt-report-october-2025-38-6-million-lost-across-9-exploits","name":"de.fi","type":"other","credibility":3},{"url":"https://x.com/SharwaFinance","name":"x.com","type":"other","credibility":3}],"severity":"medium"},{"content":"As of late May 2026, Sharwa.Finance's TVL stands at approximately $3,944 according to DefiLlama, compared to pre-exploit levels that supported the $147,000 attack in October 2025. The protocol is ranked approximately #402 among derivatives protocols by TVL, placing it at the extreme low end of the tracked ecosystem. The protocol has experienced two documented security incidents within an eight-month window, both attributed to oracle price manipulation vulnerabilities. The first incident occurred despite an explicit critical-severity audit finding from Pashov Audit Group warning of the exact exploit vector over a year in advance. New deployments were made without re-audit. The team's commitment to reimburse all affected users from the October 2025 attack has not been independently verified, and the financial capacity of the protocol to fulfill that commitment is unclear given the current TVL. Any prospective user or liquidity provider should treat the protocol as carrying elevated smart contract risk, and should note that the security track record includes repeated instances of the same vulnerability class remaining unmitigated across multiple contract deployments.","heading":"Current Status and Risk Assessment","sources":[{"url":"https://defillama.com/protocol/sharwa.finance","name":"defillama.com","type":"other","credibility":3},{"url":"https://blog.verichains.io/p/vulnerability-analysis-deconstructing","name":"blog.verichains.io","type":"other","credibility":3},{"url":"https://quadrigainitiative.com/casestudy/sharwafinancemargintradingsandwichattacksolvencyflaw.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2024-06-17","event":"Pashov Audit Group publishes security review of SharwaFinance/MarginTrading, identifying four critical-severity findings including C-01 Uniswap Spot Price Manipulation, explicitly warning that reliance on Uniswap V3 spot prices enables flash loan exploitation.","source":""},{"date":"2025-10-02","event":"Sharwa.Finance deploys a new version of the FacadeTradeRouter contract (18 days before the exploit), reportedly without re-applying the oracle fix recommended in the Pashov audit.","source":""},{"date":"2025-10-20","event":"Sharwa.Finance exploited on Arbitrum via flash loan price oracle manipulation. Attackers use a large USDC flash loan from Morpho to manipulate a Uniswap V3 pool and withdraw excess value through the FacadeTradeRouter contract. Total losses approximately $147,000.","source":""},{"date":"2025-10-23","event":"FailSafe publishes exploit analysis identifying two separate attackers, attributing approximately $61,000 and $85,000 in profits respectively to an absence of insolvency checks in the MarginTrading swap function.","source":""},{"date":"2025-10-27","event":"Sharwa.Finance team posts attack post-mortem on X, commits to 100% reimbursement of affected users, and implements Reduce-Only mode blocking new positions.","source":""},{"date":"2025-10-27","event":"Additional exploit transactions documented on Arbitrum network; $40,000 of stolen funds recovered.","source":""},{"date":"2025-10-27","event":"Verichains publishes vulnerability analysis of the Sharwa Finance exploit, confirming the oracle manipulation vector and noting the prior Pashov audit finding.","source":""},{"date":"2026-05","event":"Sharwa.Finance suffers a second security incident attributed to oracle price manipulation on Arbitrum, resulting in approximately $32,850 in losses according to DefiLlama protocol data.","source":"","date_original":"2026-05-01"}],"sources_used":[{"url":"https://defillama.com/protocol/sharwa.finance","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20251102101702/https://defillama.com/protocol/sharwa.finance","credibility":3,"archive_timestamp":"2025-11-02T10:17:02+00:00"},{"url":"https://sharwa.finance/app.html","name":"sharwa.finance","type":"other","archive_url":"https://web.archive.org/web/20260829081803/https://sharwa.finance/app.html#/trade/margin","credibility":3,"archive_timestamp":"2026-08-29T08:18:03+00:00"},{"url":"https://blog.verichains.io/p/vulnerability-analysis-deconstructing","name":"blog.verichains.io","type":"other","archive_url":"http://web.archive.org/web/20260608052801/https://blog.verichains.io/p/vulnerability-analysis-deconstructing","credibility":3,"archive_timestamp":"2026-06-08T05:28:01+00:00"},{"url":"https://getfailsafe.com/sharwafinance-exploit-analysis/","name":"getfailsafe.com","type":"other","archive_url":"http://web.archive.org/web/20260212004436/https://getfailsafe.com/sharwafinance-exploit-analysis","credibility":3,"archive_timestamp":"2026-02-12T00:44:36+00:00"},{"url":"https://quadrigainitiative.com/casestudy/sharwafinancemargintradingsandwichattacksolvencyflaw.php","name":"quadrigainitiative.com","type":"other","archive_url":"http://web.archive.org/web/20260316145843/https://quadrigainitiative.com/casestudy/sharwafinancemargintradingsandwichattacksolvencyflaw.php","credibility":3,"archive_timestamp":"2026-03-16T14:58:43+00:00"},{"url":"https://blockthreat.com/blockthreat-week-43-2025/","name":"blockthreat.com","type":"other","archive_url":"http://web.archive.org/web/20260313165844/https://blockthreat.com/blockthreat-week-43-2025/","credibility":3,"archive_timestamp":"2026-03-13T16:58:44+00:00"},{"url":"https://de.fi/blog/defi-rekt-report-october-2025-38-6-million-lost-across-9-exploits","name":"de.fi","type":"other","archive_url":"http://web.archive.org/web/20260816034704/https://de.fi/blog/defi-rekt-report-october-2025-38-6-million-lost-across-9-exploits","credibility":3,"archive_timestamp":"2026-08-16T03:47:04+00:00"},{"url":"https://github.com/pashov/audits/blob/master/team/md/SharwaFinance-security-review.md","name":"github.com","type":"other","archive_url":"http://web.archive.org/web/20260819065606/https://github.com/pashov/audits/blob/master/team/md/SharwaFinance-security-review.md","credibility":3,"archive_timestamp":"2026-08-19T06:56:06+00:00"},{"url":"https://x.com/SharwaFinance","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:15.09889+00:00","updated_at":"2026-08-29T09:21:00.921531+00:00"}}