{"investigation":{"slug":"sonne-finance","entity_name":"Sonne Finance","trust_score":52,"severity_base":null,"score_modifier":42,"confidence":1,"status":"published","content_type":"investigation","summary":"Sonne Finance is a Compound V2 fork deployed on Optimism that was exploited for approximately $20 million on May 14, 2024, in what became the largest exploit in Optimism's history. The attack exploited a well-known precision-loss donation vulnerability in Compound V2 forks, triggered during the rollout of a new VELO token market; the attacker leveraged a multi-transaction deployment architecture and a two-day timelock window to manipulate exchange rates and drain user funds.","sections":[{"content":"Sonne Finance is a decentralized lending and borrowing protocol deployed on Optimism (launched September 2022) and later expanded to Base. It is a fork of Compound Finance V2, allowing users to supply and borrow assets permissionlessly. The protocol issued the SONNE governance token and received a $600,000 grant from the Optimism Foundation to bootstrap liquidity. The founding team is anonymous; public references identify at least one founder by the pseudonym 'Wilbur.' The protocol operated under a 2-of-3 multisig governance structure. Prior to the May 2024 exploit, Sonne Finance held tens of millions of dollars in total value locked on Optimism and was regarded as one of the chain's primary native lending venues.","heading":"Background","sources":[{"url":"https://docs.sonne.finance/","name":"","type":"other","credibility":3},{"url":"https://blog.mexc.com/what-is-sonne-finance-sonne-creator-wilbur/","name":"","type":"other","credibility":3},{"url":"https://defillama.com/protocol/sonne-finance","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On May 14, 2024, Sonne Finance was drained of approximately $20 million across multiple tokens including VELO, WETH, USDC.e, WBTC, wstETH, USDT, and USDC. The attack is classified as a 'donation attack' or 'zero-supply attack,' a precision-loss vulnerability class well documented in Compound V2 forks since at least the Hundred Finance exploit of April 2023.\n\nThe attack vector was enabled by governance decisions made ten days earlier. On May 4, 2024, Sonne Improvement Proposal 15 was introduced to list the VELO token (Velodrome Finance's native token) as a collateral market. The proposal passed unanimously with 2.3 million SONNE votes on May 7. The team then queued a series of transactions on their multisig, including market creation and collateral factor configuration, subject to a mandatory two-day timelock.\n\nCritically, the team structured these operations as separate, permissionless transactions rather than batching them atomically. This created a window during which an attacker could insert transactions between the market creation call and the collateral factor assignment. On May 12, the attacker executed a preparatory transaction, and on May 14, when the timelock expired, the attacker executed the exploit.\n\nThe mechanism: the attacker flash-loaned 35,569,150 VELO and donated them directly to the newly created soVELO contract, bypassing the standard mint pathway. Because no soVELO tokens were minted, the contract's totalCash increased while totalSupply remained at zero. This inflated the exchangeRate dramatically. The attacker then exploited truncation rounding in the redeemUnderlying function, redeeming 35,471,603 VELO using only 1 wei of soVELO — instead of the mathematically required ~2 wei — due to integer division truncation. This allowed the attacker to extract underlying tokens from other markets using artificially inflated collateral values.\n\nThe exploit transaction hash is 0x9312ae377d7ebdf3c7c3a86f80514878deb5df51aad38b6191d55db53e42b7f0. The Sonne Finance team became aware of the attack approximately 25 minutes after it occurred, at which point the funds had already been drained. The SONNE token fell more than 60% on the day of the exploit, reaching approximately $0.026, and its market capitalization dropped to roughly $4.25 million.","heading":"The Exploit","sources":[{"url":"https://medium.com/@SonneFinance/post-mortem-sonne-finance-exploit-12f3daa82b06","name":"","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/sonne-finance-incident-analysis","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-sonne-finance-hack-may-2024","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/294508/lending-protocol-sonne-finance-faces-20-million-exploit-pauses-markets-on-optimism","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2024/05/15/sonne-finance-token-drops-60-after-20m-exploit-on-optimism","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Multiple security researchers and on-chain analytics firms traced the exploit across several attacker-controlled addresses on Optimism and Ethereum mainnet.\n\nPrimary attacker addresses identified:\n- 0xae4a7cde7c99fb98b0d5fa414aa40f0300531f43 (primary EOA)\n- 0x02fa2625825917e9b1f8346a465de1bbc150c5b9 (attacker contract)\n- 0x5d0d99e9886581ff8fcb01f35804317f5ed80bbb (held ~$10.67M at time of analysis)\n- 0x6277ab36a67cfb5535b02ee95c835a5eec554c07 (held ~$7.79M, bridged to ETH mainnet)\n- 0x3b39652151102d19ca41544a635956ef97416598\n- 0x4fac0651bcc837bf889f6a7d79c1908419fe1770\n- 0x9f09ec563222fe52712dc413d0b7b66cb5c7c795\n- 0xbd18100a168321701955e348f03d0df4f517c13b\n- 0x7e97b74252b6df53caf386fb4c54d4fb59cb6928\n\nPrimary exploit transaction: 0x9312ae377d7ebdf3c7c3a86f80514878deb5df51aad38b6191d55db53e42b7f0\n\nStolen assets included VELO, WETH, USDC.e, WBTC, wstETH, USDT, and USDC. A portion of funds was bridged from Optimism to Ethereum mainnet. On May 26, 2024, the attacker transferred 1,600 ETH (approximately $6.2 million at the time) to Tornado Cash in an apparent laundering attempt. Approximately $6.5 million in additional protocol funds was preserved when a SEAL contributor intervened by adding VELO tokens to the market before the attacker could drain it.","heading":"On-Chain Evidence","sources":[{"url":"https://www.certik.com/resources/blog/sonne-finance-incident-analysis","name":"","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/sonne-finance-exploit-tracing-the-20-million-lost-to-the-hack-79140bbc3e7d","name":"","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/sonne-finance-hack","name":"","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=sonne-finance-hack","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Immediately following discovery of the exploit, the Sonne Finance team paused all markets on Optimism. Markets on Base were reported as unaffected. The team engaged SEAL 911 (Security Alliance) for incident response coordination.\n\nSonne Finance publicly offered the attacker a 10% bounty in exchange for return of the stolen funds and a commitment not to pursue further legal or investigative action. The team stated: 'We are sincerely sorry about the situation, and we are doing everything in our power and we are in contact with anyone that can help with recovering the funds.'\n\nAccording to Nefture Security's tracing analysis, the attacker and the protocol allegedly reached a negotiated agreement. Under the alleged terms, the attacker returned most of the stolen funds while retaining approximately $7.2 million as a negotiated 'bounty.' However, this outcome is reported primarily by secondary security analysts and has not been confirmed by a Tier 1 source. Separately verified is the May 26, 2024 transfer of 1,600 ETH to Tornado Cash, which complicates any claims of full fund recovery. No regulatory filings or law enforcement actions have been publicly identified in connection with this exploit as of the date of this report.","heading":"Recovery","sources":[{"url":"https://therecord.media/sonne-finance-cryptocurrency-heist-bounty-offered","name":"","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/sonne-finance-exploit-tracing-the-20-million-lost-to-the-hack-79140bbc3e7d","name":"","type":"other","credibility":3},{"url":"https://medium.com/@SonneFinance/post-mortem-sonne-finance-exploit-12f3daa82b06","name":"","type":"other","credibility":3},{"url":"https://x.com/beefyfinance/status/1790699510496215474","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Sonne Finance presents a critical risk profile for prospective users based on the following factors:\n\n1. Exploit severity: The May 2024 attack is the largest exploit in Optimism chain history. Approximately $20 million was drained from user funds in a single transaction sequence. This is not a novel zero-day vulnerability; the precision-loss donation attack class was publicly documented following the Hundred Finance exploit of April 2023, more than a year before the Sonne Finance incident.\n\n2. Preventable architecture failure: Security researchers at Halborn, CertiK, and QuillAudits uniformly concluded that the attack was entirely preventable. Batching the market creation and collateral factor configuration into a single atomic transaction, or restricting executor privileges, would have closed the attack window. The team's multi-transaction deployment created the exploitable gap.\n\n3. Known vulnerability class ignored: Sonne Finance had allegedly implemented mitigations for this vulnerability class in other markets but failed to apply them correctly during the VELO market launch. Deploying on a known-vulnerable Compound V2 fork architecture without adequate safeguards constitutes material negligence.\n\n4. Anonymous team: The founding team is pseudonymous or anonymous, limiting accountability mechanisms available to affected users.\n\n5. Governance structure: The 2-of-3 multisig governance model, while standard, did not prevent the exploit and provides limited assurance to depositors.\n\n6. Market status post-exploit: All Optimism markets were paused following the exploit. The long-term operational status of the protocol is uncertain based on available information. The SONNE token lost over 60% of its value on the day of the exploit.\n\n7. Funds laundering: On-chain evidence confirms at least 1,600 ETH (approximately $6.2 million) was sent to Tornado Cash by the attacker on May 26, 2024, indicating that a full fund recovery is unlikely regardless of any alleged negotiated agreement.\n\nUsers who had funds deposited in Sonne Finance at the time of the exploit may have suffered permanent or partial losses. New deposits into the protocol carry elevated risk given its exploit history, anonymous team, and uncertain operational status.","heading":"Risk Assessment","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-sonne-finance-hack-may-2024","name":"","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/sonne-finance-incident-analysis","name":"","type":"other","credibility":3},{"url":"https://unchainedcrypto.com/20-million-exploited-from-sonne-finance-on-optimism/","name":"","type":"other","credibility":3},{"url":"https://cryptonews.com/news/sonne-finance-suffers-20m-exploit/","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-09","event":"Sonne Finance launches on Optimism as a Compound V2 fork.","source":"","date_original":"2022-09-01"},{"date":"2023-04-15","event":"Hundred Finance exploited via precision-loss donation attack on Compound V2 fork — the same vulnerability class later used against Sonne Finance.","source":""},{"date":"2024-05-04","event":"Sonne Improvement Proposal 15 introduced to add VELO token market to the Optimism deployment.","source":""},{"date":"2024-05-07","event":"SIP-15 passes unanimously with 2.3 million SONNE votes. Team queues multi-transaction market deployment on multisig with two-day timelock.","source":""},{"date":"2024-05-12","event":"Attacker executes preparatory transaction positioning for exploit once timelock expires.","source":""},{"date":"2024-05-14","event":"Timelock expires. Attacker executes donation attack against soVELO market, draining approximately $20 million across VELO, WETH, USDC.e, WBTC, wstETH, USDT, and USDC. SEAL contributor intervenes and preserves approximately $6.5 million in remaining funds.","source":""},{"date":"2024-05-15","event":"Sonne Finance pauses all Optimism markets. Team announces exploit publicly, offers 10% bounty to attacker for fund return. SONNE token drops over 60%.","source":""},{"date":"2024-05-26","event":"Attacker transfers 1,600 ETH (approximately $6.2 million) to Tornado Cash.","source":""}],"sources_used":[{"url":"https://docs.sonne.finance/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260421040255/https://docs.sonne.finance/","credibility":3,"archive_timestamp":"2026-04-21T04:02:55+00:00"},{"url":"https://blog.mexc.com/what-is-sonne-finance-sonne-creator-wilbur/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830200822/https://blog.mexc.com/token-reviews/what-is-sonne-finance-sonne-creator-wilbur/","credibility":3,"archive_timestamp":"2026-08-30T20:08:22+00:00"},{"url":"https://defillama.com/protocol/sonne-finance","name":"","type":"other","archive_url":"http://web.archive.org/web/20250913162204/https://defillama.com/protocol/sonne-finance","credibility":3,"archive_timestamp":"2025-09-13T16:22:04+00:00"},{"url":"https://medium.com/@SonneFinance/post-mortem-sonne-finance-exploit-12f3daa82b06","name":"","type":"other","archive_url":"http://web.archive.org/web/20260322055926/https://medium.com/@SonneFinance/post-mortem-sonne-finance-exploit-12f3daa82b06","credibility":3,"archive_timestamp":"2026-03-22T05:59:26+00:00"},{"url":"https://www.certik.com/resources/blog/sonne-finance-incident-analysis","name":"","type":"other","archive_url":"http://web.archive.org/web/20251016165609/https://www.certik.com/resources/blog/sonne-finance-incident-analysis","credibility":3,"archive_timestamp":"2025-10-16T16:56:09+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-sonne-finance-hack-may-2024","name":"","type":"other","archive_url":"http://web.archive.org/web/20260517002829/https://www.halborn.com/blog/post/explained-the-sonne-finance-hack-may-2024","credibility":3,"archive_timestamp":"2026-05-17T00:28:29+00:00"},{"url":"https://www.theblock.co/post/294508/lending-protocol-sonne-finance-faces-20-million-exploit-pauses-markets-on-optimism","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/tech/2024/05/15/sonne-finance-token-drops-60-after-20m-exploit-on-optimism","name":"","type":"other","archive_url":"http://web.archive.org/web/20260203082853/https://www.coindesk.com/tech/2024/05/15/sonne-finance-token-drops-60-after-20m-exploit-on-optimism","credibility":3,"archive_timestamp":"2026-02-03T08:28:53+00:00"},{"url":"https://medium.com/coinmonks/sonne-finance-exploit-tracing-the-20-million-lost-to-the-hack-79140bbc3e7d","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.quillaudits.com/blog/hack-analysis/sonne-finance-hack","name":"","type":"other","archive_url":"http://web.archive.org/web/20260626164058/https://www.quillaudits.com/blog/hack-analysis/sonne-finance-hack","credibility":3,"archive_timestamp":"2026-06-26T16:40:58+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=sonne-finance-hack","name":"","type":"other","archive_url":"http://web.archive.org/web/20260724162246/https://www.web3isgoinggreat.com/?id=sonne-finance-hack","credibility":3,"archive_timestamp":"2026-07-24T16:22:46+00:00"},{"url":"https://therecord.media/sonne-finance-cryptocurrency-heist-bounty-offered","name":"","type":"other","archive_url":"http://web.archive.org/web/20260413010359/https://therecord.media/sonne-finance-cryptocurrency-heist-bounty-offered","credibility":3,"archive_timestamp":"2026-04-13T01:03:59+00:00"},{"url":"https://x.com/beefyfinance/status/1790699510496215474","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://unchainedcrypto.com/20-million-exploited-from-sonne-finance-on-optimism/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830122938/https://unchainedcrypto.com/20-million-exploited-from-sonne-finance-on-optimism/","credibility":3,"archive_timestamp":"2026-08-30T12:29:38+00:00"},{"url":"https://cryptonews.com/news/sonne-finance-suffers-20m-exploit/","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:32.619295+00:00","updated_at":"2026-08-30T20:30:06.593548+00:00"}}