{"investigation":{"slug":"vesper-finance","entity_name":"Vesper Finance","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Vesper Finance is an Ethereum-based DeFi yield aggregator co-founded by former Bitcoin Core developer Jeff Garzik that launched in early 2021 and briefly exceeded $1 billion in TVL. The protocol suffered a confirmed $3.37 million oracle manipulation exploit on Rari Fuse Pool #23 in November 2021, and was indirectly exposed to a May 2024 Sonne Finance exploit that required treasury remediation. Vesper remains operational as of 2025 with approximately $48–55 million TVL, though its native VSP token has lost over 99% of its all-time-high value.","sections":[{"content":"Vesper Finance is a multi-chain DeFi yield aggregator that launched its beta in February 2021. It operates as a 'metalayer' routing user deposits into higher-yield DeFi strategies. The protocol offers Grow Pools (single-asset compounding), Earn Pools (yield paid in a different asset from the deposit), and Lend Pools. It is deployed on Ethereum, Polygon, Avalanche, Optimism, and Base. At its peak in early 2021, Vesper accumulated over $1 billion in total value locked (TVL) within six weeks of launch. As of early 2026, TVL stands at approximately $48 million, concentrated primarily on Ethereum (~80%). The protocol is non-custodial and governed by holders of its native VSP token via Snapshot voting.","heading":"Protocol Overview","sources":[{"url":"https://cointelegraph.com/news/jeff-garzik-s-defi-protocol-vesper-finance-tops-1b-tvl-in-six-weeks","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/vesper","name":"defillama.com","type":"other","credibility":3},{"url":"https://docs.vesper.finance/","name":"docs.vesper.finance","type":"other","credibility":3}],"severity":"medium"},{"content":"Vesper Finance was co-founded by Jeff Garzik, Matthew Roszak, and Jordan Kruger. Jeff Garzik is a former Bitcoin Core developer who later became a prominent figure in the Bitcoin scaling debate as lead developer of SegWit2x (BTC1). Garzik was expelled from the Bitcoin Core GitHub repository in 2017 following his advocacy for the New York Agreement (NYA), a proposal that was widely rejected by the Bitcoin developer and user community. Garzik also co-founded Bloq, a blockchain enterprise software company. His prior involvement in the contentious SegWit2x fork attempt has made him a polarizing figure in certain crypto communities, though no regulatory charges or fraud findings have been made against him in connection with Vesper Finance.","heading":"Founding Team and Background","sources":[{"url":"https://cointelegraph.com/news/jeff-garzik-segwit2x-bitcoin-upgrade-comments-spark-trolling-campaign","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.ccn.com/segwit2x-dev-jeff-garzik-expelled-from-bitcoin-core-repository/","name":"ccn.com","type":"other","credibility":3},{"url":"https://www.crunchbase.com/person/jeff-garzik","name":"crunchbase.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 2, 2021, at approximately 14:00 UTC, an attacker exploited Vesper's beta lending product deployed on Rari Capital's Fuse Pool #23. The attacker funded the attack with 100 ETH sourced from Tornado Cash. The exploit proceeded in several steps: the attacker swapped 58 ETH for USDC, then purchased all available VUSD tokens on Uniswap v3's 0.05% fee pool, pushing the VUSD price out-of-range. They then created a fake liquidity position at a price of trillions of VUSD per USDC, causing the Uniswap v3 time-weighted average price (TWAP) oracle to report VUSD's price as effectively infinite. Rari Fuse Pool #23, which used this oracle as its price feed, accepted the manipulated VUSD as near-infinite collateral, allowing the attacker to borrow approximately $3.5 million in pool assets. After accounting for attack costs, the net loss was confirmed at approximately $3.37 million. The attacker's address is 0xa3f447feb0b2bddc50a44ccd6f412a5f98619264. The Vesper team paused borrowing and set the VUSD collateral factor to zero upon discovery, and coordinated with Rari Capital, Yearn, and Uniswap. The team stated an intention to 'make everybody whole' but did not provide a definitive public confirmation of full compensation in disclosed post-incident reports.","heading":"November 2021 Oracle Manipulation Exploit ($3.37 Million)","sources":[{"url":"https://www.web3isgoinggreat.com/?id=2021-11-02-0","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://medium.com/vesperfinance/on-the-vesper-lend-beta-rari-fuse-pool-23-exploit-9043ccd40ac9","name":"medium.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/hackfraudscam/vesperfinanceoracleattack.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://fairyproof.substack.com/p/preliminary-analysis-of-attack-on-vesper-lend-beta-31844b6c274c","name":"fairyproof.substack.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In May 2024, Sonne Finance, a lending protocol on Optimism, suffered an exploit resulting in approximately $20 million in losses. Three Vesper pools on Optimism (OP, USDC, and wstETH) had active strategies depositing into Sonne Finance at the time. As a result of the exploit, these pools were unable to process withdrawals. Vesper Finance subsequently used $156,833 from the Vesper Finance Treasury to pay down residual debt on the affected Optimism pools, restoring user access to funds. The remediation was approved via a community governance proposal. All affected Vesper Optimism pools were confirmed back in operation following the treasury allocation. Vesper was an indirect victim in this case rather than a directly exploited party.","heading":"May 2024 Sonne Finance Exploit Exposure","sources":[{"url":"https://gov.vesper.finance/t/discussion-sonne-exploit-remediation/158","name":"gov.vesper.finance","type":"other","credibility":3},{"url":"https://x.com/VesperFi/status/1794100976355283022","name":"x.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In March 2023, a vulnerability was discovered in Vesper's rebalance mechanism by the Dedaub security research team and disclosed responsibly. The flaw allowed a malicious actor to intercept the yield-generating rebalance swap between Vesper's yield and the WETH/VSP Uniswap pool, effectively stealing yield rather than principal. No user principal funds were at risk; only yields were exposed. The maximum historical value at risk was estimated at 78.6 ETH. The vulnerability was never exploited. Vesper patched the issue promptly and subsequently launched a formal bug bounty program on Immunefi with a maximum payout of $200,000. An undisclosed bounty was paid to the Dedaub team.","heading":"2023 Rebase Vulnerability (Unexecuted)","sources":[{"url":"https://medium.com/immunefi/vesper-rebase-vulnerability-postmortem-and-bug-bounty-55354a49d184","name":"medium.com","type":"other","credibility":3},{"url":"https://immunefi.com/bug-bounty/vesper/","name":"immunefi.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The VSP token reached an all-time high of approximately $45.66 in early 2021, coinciding with Vesper's peak TVL above $1 billion. By end of 2021, the token had declined approximately 94% from its peak to around $2.80. In 2022, VSP fell further from approximately $2.77 to $0.275, a decline of roughly 90% over the year. As of 2025, VSP trades at approximately $0.25, representing a loss of over 99% from its all-time high. The Vesper DAO enacted a governance change to move from a vVSP (vote-escrowed) model to a locked VSP model to improve token utility and long-term holder alignment. VSP buyback mechanisms were restarted in August 2024 following a community vote.","heading":"VSP Token Performance and Tokenomics","sources":[{"url":"https://www.coingecko.com/en/coins/vesper-finance","name":"coingecko.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/vesper/","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Vesper Finance states that it adheres to a practice of independent smart contract audits on every user-facing smart contract, including pools, reward contracts, and yield strategies, with over 50 audits conducted across the span of its engineering history. Audit reports are published in a public GitHub repository. The protocol maintains an active bug bounty on Immunefi with a maximum payout of $200,000 for critical smart contract vulnerabilities. Despite this audit coverage, the November 2021 exploit occurred against a beta product (Vesper Lend), which carried explicit beta-stage risk disclosures. The protocol's risk documentation acknowledges that DeFi interactions with third-party protocols, such as Rari Fuse and Sonne Finance, introduce composability risks that cannot be fully mitigated by internal audits alone.","heading":"Security Posture and Audits","sources":[{"url":"https://docs.vesper.finance/reports/smart-contract-audits","name":"docs.vesper.finance","type":"other","credibility":3},{"url":"https://immunefi.com/bug-bounty/vesper/","name":"immunefi.com","type":"other","credibility":3},{"url":"https://docs.vesper.finance/vesper-pools-and-strategies/risk-framework","name":"docs.vesper.finance","type":"other","credibility":3}],"severity":"medium"},{"content":"As of early 2026, Vesper Finance continues to operate with approximately $48 million in TVL, its highest level since 2022, supported by expansion to Base and Optimism. The protocol issues regular monthly performance reports via its Medium blog. The Vesper treasury was valued at approximately $460,649 as of November 2025. VSP's current market capitalization is approximately $769,000, ranking the token around #3273 on CoinGecko. No regulatory actions, SEC enforcement, or fraud investigations have been identified against Vesper Finance or its founders in connection with the protocol's operations. No ZachXBT public report specifically naming Vesper Finance as a scam or fraud was identified in research for this investigation; the flagging context provided may relate to association with third-party exploits or general DeFi risk flagging.","heading":"Current Status and Protocol Health","sources":[{"url":"https://defillama.com/protocol/vesper","name":"defillama.com","type":"other","credibility":3},{"url":"https://medium.com/vesperfinance/vesper-performance-report-november-2024-90c80c24f7a5","name":"medium.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/vesper-finance","name":"coingecko.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-02","event":"Vesper Finance launches beta on Ethereum, co-founded by Jeff Garzik, Matthew Roszak, and Jordan Kruger.","source":"","date_original":"2021-02-01"},{"date":"2021-03","event":"Vesper Finance surpasses $1 billion in TVL within approximately six weeks of launch.","source":"","date_original":"2021-03-01"},{"date":"2021-11-02","event":"Oracle manipulation attack on Rari Fuse Pool #23 (Vesper Lend Beta) results in $3.37 million stolen. Attacker used Tornado Cash and Uniswap v3 TWAP manipulation. Attacker address: 0xa3f447feb0b2bddc50a44ccd6f412a5f98619264.","source":""},{"date":"2023-03-16","event":"Dedaub team discovers rebase vulnerability in Vesper's yield rebalance mechanism. Vulnerability is disclosed responsibly, patched before any exploitation, and a bug bounty is paid.","source":""},{"date":"2023","event":"Vesper joins Immunefi with a $200,000 maximum bug bounty program for smart contract vulnerabilities.","source":"","date_original":"2023-01-01"},{"date":"2024-05-14","event":"Sonne Finance exploit (~$20 million total) indirectly affects three Vesper Optimism pools (OP, USDC, wstETH), restricting withdrawals.","source":""},{"date":"2024-05-21","event":"Vesper governance approves $156,833 treasury allocation to remediate Sonne-related pool debt; all Optimism pools restored to operation.","source":""},{"date":"2024-08","event":"Vesper DAO votes to restart VSP buyback mechanisms and transitions from vVSP to locked VSP tokenomics model.","source":"","date_original":"2024-08-01"},{"date":"2025-11","event":"Vesper treasury reaches approximately $460,649; protocol reports TVL near $55 million, highest since 2022.","source":"","date_original":"2025-11-01"}],"sources_used":[{"url":"https://cointelegraph.com/news/jeff-garzik-s-defi-protocol-vesper-finance-tops-1b-tvl-in-six-weeks","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260411122921/https://cointelegraph.com/news/jeff-garzik-s-defi-protocol-vesper-finance-tops-1b-tvl-in-six-weeks","credibility":3,"archive_timestamp":"2026-04-11T12:29:21+00:00"},{"url":"https://defillama.com/protocol/vesper","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250917012830/https://defillama.com/protocol/vesper","credibility":3,"archive_timestamp":"2025-09-17T01:28:30+00:00"},{"url":"https://docs.vesper.finance/","name":"docs.vesper.finance","type":"other","archive_url":"http://web.archive.org/web/20260521074516/https://docs.vesper.finance/","credibility":3,"archive_timestamp":"2026-05-21T07:45:16+00:00"},{"url":"https://cointelegraph.com/news/jeff-garzik-segwit2x-bitcoin-upgrade-comments-spark-trolling-campaign","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260830083756/https://cointelegraph.com/news/jeff-garzik-segwit2x-bitcoin-upgrade-comments-spark-trolling-campaign","credibility":3,"archive_timestamp":"2026-08-30T08:37:56+00:00"},{"url":"https://www.ccn.com/segwit2x-dev-jeff-garzik-expelled-from-bitcoin-core-repository/","name":"ccn.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.crunchbase.com/person/jeff-garzik","name":"crunchbase.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.web3isgoinggreat.com/?id=2021-11-02-0","name":"web3isgoinggreat.com","type":"other","archive_url":"https://web.archive.org/web/20260830094152/https://www.web3isgoinggreat.com/?id=2021-11-02-0","credibility":3,"archive_timestamp":"2026-08-30T09:41:52+00:00"},{"url":"https://medium.com/vesperfinance/on-the-vesper-lend-beta-rari-fuse-pool-23-exploit-9043ccd40ac9","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.quadrigainitiative.com/hackfraudscam/vesperfinanceoracleattack.php","name":"quadrigainitiative.com","type":"other","archive_url":"https://web.archive.org/web/20260830132931/https://www.quadrigainitiative.com/hackfraudscam/vesperfinanceoracleattack.php","credibility":3,"archive_timestamp":"2026-08-30T13:29:31+00:00"},{"url":"https://fairyproof.substack.com/p/preliminary-analysis-of-attack-on-vesper-lend-beta-31844b6c274c","name":"fairyproof.substack.com","type":"other","archive_url":"https://web.archive.org/web/20260830125904/https://fairyproof.substack.com/p/preliminary-analysis-of-attack-on-vesper-lend-beta-31844b6c274c","credibility":3,"archive_timestamp":"2026-08-30T12:59:04+00:00"},{"url":"https://gov.vesper.finance/t/discussion-sonne-exploit-remediation/158","name":"gov.vesper.finance","type":"other","archive_url":"https://web.archive.org/web/20260830163529/https://gov.vesper.finance/t/discussion-sonne-exploit-remediation/158","credibility":3,"archive_timestamp":"2026-08-30T16:35:29+00:00"},{"url":"https://x.com/VesperFi/status/1794100976355283022","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://medium.com/immunefi/vesper-rebase-vulnerability-postmortem-and-bug-bounty-55354a49d184","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20250908131230/https://medium.com/immunefi/vesper-rebase-vulnerability-postmortem-and-bug-bounty-55354a49d184","credibility":3,"archive_timestamp":"2025-09-08T13:12:30+00:00"},{"url":"https://immunefi.com/bug-bounty/vesper/","name":"immunefi.com","type":"other","archive_url":"https://web.archive.org/web/20260830085916/https://immunefi.com/bug-bounty/vesper/information/","credibility":3,"archive_timestamp":"2026-08-30T08:59:16+00:00"},{"url":"https://www.coingecko.com/en/coins/vesper-finance","name":"coingecko.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinmarketcap.com/currencies/vesper/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260518193432/https://coinmarketcap.com/currencies/vesper/","credibility":3,"archive_timestamp":"2026-05-18T19:34:32+00:00"},{"url":"https://docs.vesper.finance/reports/smart-contract-audits","name":"docs.vesper.finance","type":"other","archive_url":"http://web.archive.org/web/20260521081538/https://docs.vesper.finance/reports/smart-contract-audits","credibility":3,"archive_timestamp":"2026-05-21T08:15:38+00:00"},{"url":"https://docs.vesper.finance/vesper-pools-and-strategies/risk-framework","name":"docs.vesper.finance","type":"other","archive_url":"http://web.archive.org/web/20260521082953/https://docs.vesper.finance/vesper-pools-and-strategies/risk-framework","credibility":3,"archive_timestamp":"2026-05-21T08:29:53+00:00"},{"url":"https://medium.com/vesperfinance/vesper-performance-report-november-2024-90c80c24f7a5","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:53.367889+00:00","updated_at":"2026-08-30T16:47:12.224332+00:00"}}