{"investigation":{"slug":"tender-finance","entity_name":"Tender Finance","trust_score":32,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Tender Finance (tender.fi) was an Arbitrum-based decentralized lending and borrowing protocol that suffered a $1.59 million oracle misconfiguration exploit on March 7, 2023. A white hat hacker exploited a decimal precision error in the GMX price oracle, depositing one GMX token worth approximately $71 to borrow nearly $1.6 million in assets. The hacker returned funds in exchange for a $97,000 bounty, and the project subsequently rebranded to GLend under the Gemach DAO umbrella, migrating its TND token to GLEND and later to GMAC.","sections":[{"content":"On March 7, 2023, Tender Finance suffered a critical smart contract vulnerability resulting in $1.59 million in assets being drained from the protocol. The exploit originated from a decimal precision error introduced during an upgrade to the protocol's GMX price oracle. The GMXPriceOracle.getUnderlyingPrice() method returned the GMX token price with 38 decimal places rather than the correct 18, effectively inflating the perceived value of GMX collateral by a factor of approximately 10^20. An attacker exploited this misconfiguration by depositing a single GMX token (worth approximately $71 at the time) as collateral and then borrowing $1.59 million in assets — primarily ETH — through the tETH.borrow function. The attacker left an on-chain message stating: 'It looks like your oracle was misconfigured. Contact me to sort this out,' suggesting white hat intent from the outset. The protocol halted all lending operations upon discovering the unusual borrowing activity. Tender Finance had previously undergone a security audit by PeckShield; however, the vulnerability was introduced in post-audit code changes during the oracle integration upgrade, not caught before deployment. This incident is classified as an oracle manipulation exploit rooted in inadequate testing of decimal handling across different token standards.","heading":"Oracle Misconfiguration Exploit (March 2023)","sources":[{"url":"https://www.coindesk.com/business/2023/03/10/defi-protocol-tenderfi-hacker-returns-16m-following-chainlink-oracle-glitch","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/defi-lender-tender-fi-suffers-exploit-white-hat-hacker-suspected","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://blog.solidityscan.com/tender-finance-hack-analysis-improper-oracle-price-calculation-408f424d8548","name":"blog.solidityscan.com","type":"other","credibility":3},{"url":"https://smartcontractshacking.com/hacks/tender-finance-hack-2023","name":"smartcontractshacking.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, Tender Finance engaged with the hacker, who confirmed white hat intent and agreed to return the stolen funds in exchange for a bounty. Within approximately eight hours of the initial incident, the white hat hacker returned all borrowed assets. Tender Finance paid a bounty of 62.158670296 ETH (valued at approximately $97,000 at the time), representing roughly 6% of the exploited amount. The protocol's team confirmed all loan repayments were completed and stated user funds were safe ('SaFu'). The team committed to deploying a rewritten oracle contract before resuming borrowing operations. GLend's team — the entity developing Tender Finance — agreed to reimburse the bounty amount to the protocol from its own treasury to ensure no outstanding bad debt remained and that users would not suffer losses. The CoinDesk report noted the bug was in Tender.fi's integration code, not in the Chainlink oracle itself.","heading":"Resolution and White Hat Bounty","sources":[{"url":"https://www.coindesk.com/business/2023/03/10/defi-protocol-tenderfi-hacker-returns-16m-following-chainlink-oracle-glitch","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/217823/tender-fi-hacker-returns-stolen-funds-gets-bounty-reward","name":"theblock.co","type":"other","credibility":3},{"url":"https://beincrypto.com/hacker-returns-stolen-funds-defi-lending-tender-fi/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://www.bitdegree.org/crypto/news/white-hat-hacker-exploits-defi-lending-platform-tender-fi-for-1-59-million","name":"bitdegree.org","type":"other","credibility":3}],"severity":"medium"},{"content":"Tender Finance engaged PeckShield to conduct a smart contract security audit prior to launch. The PeckShield audit report is publicly available on GitHub. However, the critical oracle misconfiguration vulnerability was introduced after the audit was completed, during a subsequent upgrade to the protocol's price feed. This demonstrates a recognized risk pattern in DeFi: post-audit code changes that are not re-audited or thoroughly tested can introduce new critical vulnerabilities regardless of prior audit coverage. Multiple security analysts cited inadequate testing of decimal handling and insufficient validation of oracle price feed integrity as the root causes. The incident is frequently cited in educational materials about oracle manipulation vulnerabilities in DeFi lending protocols.","heading":"Security Audit and Code Quality Concerns","sources":[{"url":"https://github.com/peckshield/publications/blob/master/audit_reports/PeckShield-Audit-Report-Tender-v1.0.pdf","name":"github.com","type":"other","credibility":3},{"url":"https://blog.solidityscan.com/tender-finance-hack-analysis-improper-oracle-price-calculation-408f424d8548","name":"blog.solidityscan.com","type":"other","credibility":3},{"url":"https://smartcontractshacking.com/hacks/tender-finance-hack-2023","name":"smartcontractshacking.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the March 2023 exploit and subsequent recovery, Tender Finance continued operating under the Gemach DAO umbrella and eventually rebranded. In October 2023, the project applied for Arbitrum's Short Term Incentive Program (STIP) Round 2 under the 'Tender Finance' name. The @Tender_fi Twitter/X account announced a token migration in October 2023, transitioning from the TND governance token to a new GLEND token on a 1:1 basis (with an average bonus of approximately 9% factoring in multiplier points and escrowed TND). The project was subsequently known as GLend by Gemach DAO. A further token migration from GLEND to GMAC (Gemach's native token) was announced to fund development. As of data available from DeFi Llama, the protocol retained a small TVL of approximately $268,000 on Arbitrum with minimal daily activity (1 active address, 1 transaction per day). The @Tender_fi account on X was repurposed to represent GLend / GemachLend.","heading":"Rebrand to GLend / Gemach DAO","sources":[{"url":"https://gemachlend.medium.com/unlocking-value-gemach-lends-token-migration-and-bonus-overhaul-91ad0579dcfa","name":"gemachlend.medium.com","type":"other","credibility":3},{"url":"https://forum.arbitrum.foundation/t/tender-finance-draft-stip-round-2/19042","name":"forum.arbitrum.foundation","type":"other","credibility":3},{"url":"https://defillama.com/protocol/tender-finance","name":"defillama.com","type":"other","credibility":3},{"url":"https://docs.gemach.io/gemach-dao/products/glend","name":"docs.gemach.io","type":"other","credibility":3},{"url":"https://iq.wiki/wiki/glend-by-gemach-dao","name":"iq.wiki","type":"other","credibility":3}],"severity":"medium"},{"content":"As of data available through DeFi Llama, Tender Finance / GLend maintains a TVL of approximately $268,000 on Arbitrum, with active loans totaling approximately $500,000. Daily activity is minimal, with approximately one active address and one transaction per day. The TND token reached an all-time high of approximately $7.60 on February 20, 2023 — shortly before the exploit — and subsequently declined significantly. The total supply of TND is 10,000,000 tokens, with the project noting 0 in active circulation following the migration to GLEND. The protocol operates 14 yield pools with an average APY of approximately 13.66%. The protocol's long-term viability remains uncertain given its very low TVL and minimal user activity relative to competing Arbitrum-based lending protocols such as Aave V3.","heading":"Protocol Status and Activity","sources":[{"url":"https://defillama.com/protocol/tender-finance","name":"defillama.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/tender-fi/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/headlines/news/tender-fi-hacker-returns-stolen-funds-gets-bounty-reward/","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Tender Finance has been flagged by ZachXBT, an on-chain blockchain investigator known for exposing DeFi scams and exploits. The specific nature and full context of ZachXBT's flag on Tender Finance has not been independently verified through publicly accessible primary sources in the course of this investigation. The protocol's trust score reflects both the confirmed $1.59 million oracle exploit (a verified security incident), the subsequent rebrand and multiple token migrations (TND to GLEND to GMAC), and the ZachXBT flag. The multiple token migrations and relatively low post-exploit TVL and activity may be among the factors cited in ZachXBT's concern. This section should be treated as low confidence pending retrieval of the primary ZachXBT source.","heading":"ZachXBT Flag","sources":[],"severity":"medium"}],"timeline":[{"date":"2022","event":"Tender Finance launches on Arbitrum as a decentralized lending and borrowing protocol focused on GMX and GLP collateral.","source":"","date_original":"2022-01-01"},{"date":"2023-02-20","event":"TND token reaches its all-time high price of approximately $7.60.","source":""},{"date":"2023-03-07","event":"Oracle misconfiguration exploit: white hat hacker deposits 1 GMX token (~$71) and borrows $1.59 million due to a 38-decimal-place price error in the GMXPriceOracle contract. Tender Finance halts lending operations.","source":""},{"date":"2023-03-07","event":"Hacker leaves on-chain message: 'It looks like your oracle was misconfigured. Contact me to sort this out.' Protocol contacts hacker and negotiates fund return.","source":""},{"date":"2023-03-08","event":"White hat hacker returns all $1.59 million in funds to the protocol. Tender Finance confirms funds are safe and pays 62.16 ETH (~$97,000) bounty. CoinDesk and The Block report on the resolution.","source":""},{"date":"2023-10","event":"Tender Finance submits application for Arbitrum STIP Round 2 under the 'Gemach DAO' name.","source":"","date_original":"2023-10-01"},{"date":"2023-10-19","event":"@Tender_fi announces token migration from TND to GLEND (Gemach Lend) on a 1:1 basis.","source":""},{"date":"2024-01-15","event":"GLend (formerly Tender Finance) announces further token migration from GLEND to GMAC as part of the Gemach DAO ecosystem expansion.","source":""}],"sources_used":[{"url":"https://www.coindesk.com/business/2023/03/10/defi-protocol-tenderfi-hacker-returns-16m-following-chainlink-oracle-glitch","name":"CoinDesk: DeFi Protocol Tender.fi Hacker Returns $1.6M Following Chainlink Oracle Glitch","type":"news_article","archive_url":"https://web.archive.org/web/20260724173136/https://www.coindesk.com/business/2023/03/10/defi-protocol-tenderfi-hacker-returns-16m-following-chainlink-oracle-glitch","credibility":1,"archive_timestamp":"2026-07-24T17:31:36+00:00"},{"url":"https://cointelegraph.com/news/defi-lender-tender-fi-suffers-exploit-white-hat-hacker-suspected","name":"CoinTelegraph: DeFi lender Tender.fi suffers exploit, white hat hacker suspected","type":"news_article","archive_url":"http://web.archive.org/web/20250818163105/https://cointelegraph.com/news/defi-lender-tender-fi-suffers-exploit-white-hat-hacker-suspected","credibility":1,"archive_timestamp":"2025-08-18T16:31:05+00:00"},{"url":"https://www.theblock.co/post/217823/tender-fi-hacker-returns-stolen-funds-gets-bounty-reward","name":"The Block: Tender.fi hacker returns stolen funds, gets bounty reward","type":"news_article","archive_url":null,"credibility":1,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://beincrypto.com/hacker-returns-stolen-funds-defi-lending-tender-fi/","name":"BeInCrypto: Hacker Returns Stolen Funds to DeFi Lending Platform Tender.fi","type":"news_article","archive_url":"http://web.archive.org/web/20260129060933/https://beincrypto.com/hacker-returns-stolen-funds-defi-lending-tender-fi/","credibility":2,"archive_timestamp":"2026-01-29T06:09:33+00:00"},{"url":"https://blog.solidityscan.com/tender-finance-hack-analysis-improper-oracle-price-calculation-408f424d8548","name":"SolidityScan: Tender Finance Hack Analysis — Improper Oracle Price Calculation","type":"research","archive_url":"http://web.archive.org/web/20260724163237/https://blog.solidityscan.com/tender-finance-hack-analysis-improper-oracle-price-calculation-408f424d8548/","credibility":2,"archive_timestamp":"2026-07-24T16:32:37+00:00"},{"url":"https://smartcontractshacking.com/hacks/tender-finance-hack-2023","name":"Smart Contract Hacking: Tender Finance Hack (2023)","type":"research","archive_url":"https://web.archive.org/web/20260724211007/https://smartcontractshacking.com/hacks/tender-finance-hack-2023","credibility":2,"archive_timestamp":"2026-07-24T21:10:07+00:00"},{"url":"https://defillama.com/protocol/tender-finance","name":"DeFi Llama: Tender Finance TVL Stats & Charts","type":"on_chain","archive_url":"http://web.archive.org/web/20250910081141/https://defillama.com/protocol/tender-finance","credibility":2,"archive_timestamp":"2025-09-10T08:11:41+00:00"},{"url":"https://github.com/peckshield/publications/blob/master/audit_reports/PeckShield-Audit-Report-Tender-v1.0.pdf","name":"PeckShield Audit Report for Tender Finance","type":"research","archive_url":"http://web.archive.org/web/20260224132057/https://github.com/peckshield/publications/blob/master/audit_reports/PeckShield-Audit-Report-Tender-v1.0.pdf","credibility":1,"archive_timestamp":"2026-02-24T13:20:57+00:00"},{"url":"https://forum.arbitrum.foundation/t/tender-finance-draft-stip-round-2/19042","name":"Arbitrum Foundation: Tender Finance STIP Round 2 Application","type":"official","archive_url":"https://web.archive.org/web/20260725034133/https://forum.arbitrum.foundation/t/tender-finance-draft-stip-round-2/19042","credibility":2,"archive_timestamp":"2026-07-25T03:41:33+00:00"},{"url":"https://gemachlend.medium.com/unlocking-value-gemach-lends-token-migration-and-bonus-overhaul-91ad0579dcfa","name":"GLend Medium: Unlocking Value — Gemach Lend Token Migration","type":"other","archive_url":"http://web.archive.org/web/20250913012508/https://gemachlend.medium.com/unlocking-value-gemach-lends-token-migration-and-bonus-overhaul-91ad0579dcfa","credibility":3,"archive_timestamp":"2025-09-13T01:25:08+00:00"},{"url":"https://iq.wiki/wiki/glend-by-gemach-dao","name":"IQ.wiki: GLend by Gemach DAO","type":"other","archive_url":"http://web.archive.org/web/20251006174231/https://iq.wiki/wiki/glend-by-gemach-dao","credibility":3,"archive_timestamp":"2025-10-06T17:42:31+00:00"},{"url":"https://coinmarketcap.com/currencies/tender-fi/","name":"CoinMarketCap: Tender.fi (TND) Price","type":"other","archive_url":"https://web.archive.org/web/20260724210133/https://coinmarketcap.com/currencies/tender-fi/","credibility":2,"archive_timestamp":"2026-07-24T21:01:33+00:00"},{"url":"https://www.bitdegree.org/crypto/news/white-hat-hacker-exploits-defi-lending-platform-tender-fi-for-1-59-million","name":"BitDegree: White Hat Hacker Exploits DeFi Lending Platform Tender.fi for $1.59M","type":"news_article","archive_url":"https://web.archive.org/web/20260725190645/https://www.bitdegree.org/crypto/news/white-hat-hacker-exploits-defi-lending-platform-tender-fi-for-1-59-million","credibility":2,"archive_timestamp":"2026-07-25T19:06:45+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:43.796913+00:00","updated_at":"2026-08-29T01:34:42.315+00:00"}}