{"investigation":{"slug":"sturdy-v1","entity_name":"Sturdy V1","trust_score":54,"severity_base":null,"score_modifier":5,"confidence":0.75,"status":"published","content_type":"investigation","summary":"Sturdy V1 was the original version of Sturdy Finance, a DeFi lending protocol backed by Pantera Capital, Y Combinator and others, that allowed users to deposit yield-bearing collateral such as Curve and Balancer LP tokens. In June 2023 an attacker exploited a read-only reentrancy flaw in a Balancer pool used for price oracle data, draining roughly $770,000-$800,000; the team paused the protocol and no further user funds were reported at risk. Sturdy V1 has since been largely superseded by Sturdy V2, and a 2024 governance proposal sought to formally sunset V1, whose on-chain value has fallen to a small fraction of its earlier size.","sections":[{"content":"Sturdy Finance is a DeFi lending protocol that let users deposit yield-bearing collateral, including Curve and Balancer LP tokens and staked ETH derivatives, to borrow against it without paying standard borrowing interest; yield generated by the collateral was used to subsidize borrowing costs. The protocol launched on Ethereum and Fantom in 2022. In March 2022, Sturdy closed a $3.9 million seed and strategic funding round led by Pantera Capital, with participation from Y Combinator, SoftBank's opportunity fund, KuCoin Ventures, and other investors. Multiple independent sources, including a crypto-news aggregator report and a fundraising-tracking site, corroborate the $3.9 million figure; no credible source found during this review supports a $4.4 million figure for this round.","heading":"Protocol Overview and Funding","sources":[{"url":"https://tokeninsight.com/en/news/defi-lending-protocol-sturdy-closed-3.9-million-funding-round-led-by-pantera-capital","name":"TokenInsight: DeFi Lending Protocol Sturdy Closed $3.9 Million Funding Round Led by Pantera Capital","type":"news_article","credibility":2},{"url":"https://www.coincarp.com/fundraising/sturdy-seed/","name":"CoinCarp: Sturdy Seed fundraising record","type":"research","credibility":2},{"url":"https://www.extruct.ai/hub/sturdy-finance/","name":"Extruct AI: Sturdy Finance company hub","type":"research","credibility":3}],"severity":"low"},{"content":"On June 12, 2023, an attacker exploited Sturdy Finance's reliance on a Balancer pool (B-stETH-STABLE) for collateral pricing. Using a large flash loan, the attacker repeatedly called the Balancer pool mid-transaction to temporarily inflate the pool's reported price by roughly threefold -- a technique known as read-only reentrancy, which had previously affected other protocols including Midas Capital and dForce Network. With the inflated price in place, the attacker borrowed and withdrew collateral from Sturdy in excess of its real value, then let the price normalize, liquidated their own position, and repaid the flash loan, repeating the sequence across several contracts. Security firms BlockSec and PeckShield identified the exploit; Sturdy's team paused all markets, stated that stablecoin markets were unaffected and that no further funds were at risk, and said no user action was required. Reported loss figures vary slightly by source, ranging from approximately $770,000-$800,000 (442 ETH) to a higher estimate of roughly $884,000 (504 ETH) when including related transactions. The stolen funds were reportedly moved through the Tornado Cash mixing service shortly after the attack. The incident is attributed to a known class of oracle-manipulation vulnerability affecting Balancer pools generally, rather than to any evidence of insider wrongdoing by the Sturdy team.","heading":"June 2023 Exploit: Balancer Read-Only Reentrancy","sources":[{"url":"https://decrypt.co/144188/defi-lending-protocol-sturdy-finance-hit-by-exploit-over-750k-drained?amp=1","name":"Decrypt: DeFi Lending Protocol Sturdy Finance Hit By Exploit, Over $750K Drained","type":"news_article","credibility":2},{"url":"https://www.certik.com/resources/blog/oracle-dependency-decrypting-the-sturdy-finance-attack","name":"CertiK: Oracle Dependency - Decrypting the Sturdy Finance Attack","type":"research","credibility":2},{"url":"https://rekt.news/sturdy-rekt","name":"rekt.news: Sturdy - REKT","type":"research","credibility":2},{"url":"https://eigenphi.substack.com/p/sturdy-finance-exploit-forensic-analysis","name":"EigenPhi: Sturdy Finance Under Siege - A Forensic Analysis of the $800K Exploit","type":"research","credibility":2},{"url":"https://cointelegraph.com/news/attacker-drains-800k-from-defi-protocol-sturdy-finance","name":"Cointelegraph: Attacker drains $800K from DeFi protocol Sturdy Finance","type":"news_article","credibility":2}],"severity":"high"},{"content":"Sturdy's smart contracts were reviewed by Quantstamp, whose report (dated December 2022, covering a review conducted in late August to late September 2022) recorded 26 total findings across medium, low, informational and undetermined severity, with no high-severity issues identified, and noted that a majority of findings had been resolved or acknowledged by the project. Separate audits covering later Sturdy Aggregator contracts were conducted by ChainSecurity, which rated the reviewed codebase's security as high, and by Zellic, which identified two non-critical issues that the project said it fixed. It has been reported, including in a post-incident annotation on rekt.news, that the specific LendingPool contract version exploited in June 2023 fell outside the scope of the audits performed. A claim in a prior version of this page -- that the Quantstamp audit specifically described reliance on external oracles as posing a risk of 'catastrophic failure' -- could not be verified from the audit document itself during this review, as the certificate is a non-text-extractable PDF; this specific wording is therefore not repeated here as confirmed.","heading":"Security Audits","sources":[{"url":"https://certificate.quantstamp.com/full/sturdy.pdf","name":"Quantstamp audit certificate: Sturdy","type":"research","credibility":2},{"url":"https://chainsecurity.com/security-audit/sturdy-aggregator-smart-contracts","name":"ChainSecurity: Sturdy Aggregator Smart Contracts audit","type":"research","credibility":2},{"url":"https://reports.zellic.io/publications/sturdy/sections/summary-results","name":"Zellic: Sturdy assessment report","type":"research","credibility":2},{"url":"https://rekt.news/sturdy-rekt","name":"rekt.news: Sturdy - REKT","type":"research","credibility":2}],"severity":"medium"},{"content":"Sturdy's contributors subsequently built a second-generation protocol, Sturdy V2, which introduced isolated-risk lending silos. A governance forum proposal titled 'Formally sunset Sturdy V1' states that V1 had not received active development contributions for more than six months and that nearly all of the protocol's total value locked had moved to V2. The proposal, if passed, called for setting V1 lending rates to 0% and borrowing rates to 200% across all markets, shutting down the V1 user interface, closing the V1 bug bounty, renouncing contract ownership, and closing the claims process for users affected by the June 2023 exploit. Third-party trackers have shown Sturdy's overall total value locked at a small figure (on the order of a few hundred thousand dollars) in recent snapshots, consistent with V1 being a largely inactive, legacy deployment rather than an actively marketed product; the exact current TVL attributable specifically to V1 versus V2 could not be independently confirmed at the time of this review.","heading":"Current Status: Sunset of V1 in Favor of V2","sources":[{"url":"https://gov.sturdy.finance/t/formally-sunset-sturdy-v1/165","name":"Sturdy governance forum: Formally sunset Sturdy V1","type":"community_report","credibility":2},{"url":"https://defillama.com/protocol/sturdy","name":"DefiLlama: Sturdy protocol page","type":"on_chain","credibility":2}],"severity":"medium"},{"content":"No regulatory enforcement actions by the SEC, CFTC, DOJ, or other government authorities against Sturdy Finance or its founders have been identified in public records searched as of October 2026. No civil lawsuits against the protocol or its team were found. Sturdy Finance and its known associated addresses do not appear on the OFAC Specially Designated Nationals (SDN) list based on searches conducted for this review. As with any negative/absence claim covering multiple regulators and jurisdictions, this cannot be verified with full certainty from open-source search alone, and should be read as 'no adverse action found' rather than a guarantee that none exists.","heading":"Regulatory and Legal Status","sources":[{"url":"https://www.citationneeded.news/issue-30-sturdy-finance-isnt-atlantis/","name":"General web search for Sturdy Finance regulatory and legal actions (October 2026)","type":"other","credibility":3}],"severity":"low"}],"timeline":[{"date":"2022-03-15","event":"Sturdy Finance closes a $3.9 million seed and strategic funding round led by Pantera Capital, with Y Combinator, SoftBank, KuCoin Ventures and other investors participating.","source":"CoinCarp","source_url":"https://www.coincarp.com/fundraising/sturdy-seed/","date_evidence":"Sturdy raised $3.90M in a Seed financing round on Mar 15, 2022."},{"date":"2022-12","event":"Quantstamp publishes its security audit report on Sturdy's smart contracts, recording no high-severity findings.","source":"Quantstamp audit certificate","source_url":"https://certificate.quantstamp.com/full/sturdy.pdf"},{"date":"2023-06","event":"An attacker exploits a read-only reentrancy vulnerability tied to Balancer pool pricing to drain approximately $770,000-$800,000 from Sturdy Finance; the protocol pauses all markets.","source":"EigenPhi forensic analysis; Decrypt","source_url":"https://eigenphi.substack.com/p/sturdy-finance-exploit-forensic-analysis","date_evidence":"At 01:06:35 a.m. UTC time on June 12th, 2023, a reentrancy attack hit Sturdy Finance","date_original":"2023-06-12"},{"date":"2024","event":"A governance forum proposal calls for formally sunsetting Sturdy V1, citing the migration of nearly all TVL to Sturdy V2 and the lack of ongoing V1 development.","source":"Sturdy governance forum","source_url":"https://gov.sturdy.finance/t/formally-sunset-sturdy-v1/165"}],"sources_used":[{"url":"https://tokeninsight.com/en/news/defi-lending-protocol-sturdy-closed-3.9-million-funding-round-led-by-pantera-capital","name":"TokenInsight: DeFi Lending Protocol Sturdy Closed $3.9 Million Funding Round Led by Pantera Capital","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coincarp.com/fundraising/sturdy-seed/","name":"CoinCarp: Sturdy Seed fundraising record","type":"research","archive_url":"https://web.archive.org/web/20261028170425/https://www.coincarp.com/fundraising/sturdy-seed/","credibility":2,"archive_timestamp":"2026-10-28T17:04:25+00:00"},{"url":"https://www.extruct.ai/hub/sturdy-finance/","name":"Extruct AI: Sturdy Finance company hub","type":"research","archive_url":"http://web.archive.org/web/20260418112202/https://www.extruct.ai/hub/sturdy-finance/","credibility":3,"archive_timestamp":"2026-04-18T11:22:02+00:00"},{"url":"https://decrypt.co/144188/defi-lending-protocol-sturdy-finance-hit-by-exploit-over-750k-drained?amp=1","name":"Decrypt: DeFi Lending Protocol Sturdy Finance Hit By Exploit, Over $750K Drained","type":"news_article","archive_url":"https://web.archive.org/web/20261028165436/https://decrypt.co/144188/defi-lending-protocol-sturdy-finance-hit-by-exploit-over-750k-drained?amp=1","credibility":2,"archive_timestamp":"2026-10-28T16:54:36+00:00"},{"url":"https://www.certik.com/resources/blog/oracle-dependency-decrypting-the-sturdy-finance-attack","name":"CertiK: Oracle Dependency - Decrypting the Sturdy Finance Attack","type":"research","archive_url":"https://web.archive.org/web/20261028170355/https://www.certik.com/blog/oracle-dependency-decrypting-the-sturdy-finance-attack","credibility":2,"archive_timestamp":"2026-10-28T17:03:55+00:00"},{"url":"https://rekt.news/sturdy-rekt","name":"rekt.news: Sturdy - REKT","type":"research","archive_url":"http://web.archive.org/web/20261006142101/https://rekt.news/sturdy-rekt","credibility":2,"archive_timestamp":"2026-10-06T14:21:01+00:00"},{"url":"https://eigenphi.substack.com/p/sturdy-finance-exploit-forensic-analysis","name":"EigenPhi: Sturdy Finance Under Siege - A Forensic Analysis of the $800K Exploit","type":"research","archive_url":"https://web.archive.org/web/20261028165540/https://eigenphi.substack.com/p/sturdy-finance-exploit-forensic-analysis","credibility":2,"archive_timestamp":"2026-10-28T16:55:40+00:00"},{"url":"https://cointelegraph.com/news/attacker-drains-800k-from-defi-protocol-sturdy-finance","name":"Cointelegraph: Attacker drains $800K from DeFi protocol Sturdy Finance","type":"news_article","archive_url":"http://web.archive.org/web/20261006200020/https://cointelegraph.com/news/attacker-drains-800k-from-defi-protocol-sturdy-finance","credibility":2,"archive_timestamp":"2026-10-06T20:00:20+00:00"},{"url":"https://certificate.quantstamp.com/full/sturdy.pdf","name":"Quantstamp audit certificate: Sturdy","type":"research","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://chainsecurity.com/security-audit/sturdy-aggregator-smart-contracts","name":"ChainSecurity: Sturdy Aggregator Smart Contracts audit","type":"research","archive_url":"http://web.archive.org/web/20260508091951/https://www.chainsecurity.com/security-audit/sturdy-aggregator-smart-contracts","credibility":2,"archive_timestamp":"2026-05-08T09:19:51+00:00"},{"url":"https://reports.zellic.io/publications/sturdy/sections/summary-results","name":"Zellic: Sturdy assessment report","type":"research","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://gov.sturdy.finance/t/formally-sunset-sturdy-v1/165","name":"Sturdy governance forum: Formally sunset Sturdy V1","type":"community_report","archive_url":null,"credibility":2,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://defillama.com/protocol/sturdy","name":"DefiLlama: Sturdy protocol page","type":"on_chain","archive_url":"https://web.archive.org/web/20261028165539/https://defillama.com/protocol/sturdy","credibility":2,"archive_timestamp":"2026-10-28T16:55:39+00:00"},{"url":"https://www.citationneeded.news/issue-30-sturdy-finance-isnt-atlantis/","name":"Molly White / Citation Needed newsletter","type":"other","archive_url":"http://web.archive.org/web/20260919235048/https://www.citationneeded.news/issue-30-sturdy-finance-isnt-atlantis/","credibility":3,"archive_timestamp":"2026-09-19T23:50:48+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-05-04T02:54:41.462283+00:00","updated_at":"2026-10-29T14:03:22.614+00:00"},"source_quality":{"total":14,"tier1":0,"tier2":4,"tier3":0,"unrated":10},"follower_count":null,"content_updated_at":"2026-10-29T14:03:23.571Z","last_fact_checked_at":"2026-10-29T14:03:23.001Z","fact_check_next_allowed_at":"2026-11-05T14:03:23.001Z","update_next_allowed_at":"2026-11-03T16:16:37.524Z"}