{"investigation":{"slug":"warp-finance","entity_name":"Warp Finance","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Warp Finance was an Ethereum-based DeFi lending protocol that allowed users to borrow stablecoins against Uniswap liquidity provider (LP) tokens as collateral. On December 17–18, 2020, roughly one week after launch, an attacker exploited a manipulable AMM-based price oracle to artificially inflate LP token collateral values using flash loans, draining approximately $7.76 million in DAI and USDC. Approximately $5.85 million (roughly 75%) was subsequently recovered from the attacker's locked collateral with assistance from the white-hat community; the protocol relaunched in February 2021 with Chainlink price feeds replacing the vulnerable Uniswap oracle.","sections":[{"content":"Warp Finance was an open-source Ethereum protocol that launched on approximately December 9, 2020, with the stated goal of enabling holders of Uniswap liquidity provider (LP) tokens to use those tokens as collateral to borrow stablecoins. Prior to this, LP tokens were largely idle assets that generated trading fees but could not be leveraged for additional capital. The protocol operated two vault types: WarpVaultLP, which held the LP token collateral, and WarpVaultSC, which held the stablecoin liquidity (DAI and USDC) available for borrowing. Warp Finance's team was largely pseudonymous at the time of the exploit; public communications referred to at least one core developer operating under a pseudonym. The protocol had not undergone a comprehensive security audit prior to launch.","heading":"Protocol Overview","sources":[{"url":"https://warpfinance.medium.com/warp-finance-exploit-summary-recovery-of-funds-5b8fe4a11898","name":"Warp Finance — Exploit Summary & Recovery of Funds (Official Medium)","type":"official","credibility":2},{"url":"https://www.coindesk.com/markets/2020/12/18/warp-finance-suffers-possible-8m-flash-loan-attack","name":"Warp Finance Suffers Possible $8M Flash Loan Attack — CoinDesk","type":"news_article","credibility":1},{"url":"https://defipulse.com/warp-finance","name":"Warp Finance | DeFi Pulse","type":"other","credibility":2}],"severity":"medium"},{"content":"On December 17, 2020 at approximately 02:30 UTC, an unidentified attacker executed a multi-step flash loan attack against Warp Finance, ultimately borrowing and retaining approximately $7.76 million in stablecoins. The attacker initiated the exploit by taking four simultaneous flash loans totaling approximately 2.9 million DAI and 344,800 WETH from dYdX and Uniswap V2. Using the borrowed DAI, the attacker added liquidity to the Uniswap V2 WETH-DAI pool, minting approximately 94,349 LP tokens, which were then deposited into WarpVaultLP as collateral. The attacker then swapped approximately 341,000 WETH for roughly 47.6 million DAI via Uniswap V2, which dramatically shifted the pool's reserve ratio and caused the reported unit value of the LP tokens to approximately double (from ~$58.8 million to ~$135.5 million in aggregate). With the artificially inflated collateral value now recorded in Warp Finance's oracle, the attacker borrowed 3.86 million DAI and 3.9 million USDC — approximately $7.8 million total — from the protocol's stablecoin vaults, then repaid the original flash loans and exited with the borrowed stablecoins. The exploit contract address identified on-chain is 0xdf8bee861227ffc5eea819c332a1c170ae3dbacb.","heading":"December 2020 Flash Loan Exploit","sources":[{"url":"https://peckshield.medium.com/warpfinance-incident-root-cause-analysis-581a4869ee00","name":"WarpFinance Incident: Root Cause Analysis — PeckShield","type":"research","credibility":2},{"url":"https://slowmist.medium.com/analysis-of-warp-finance-hacked-incident-cb12a1af74cc","name":"Analysis of Warp Finance Hacked Incident — SlowMist","type":"research","credibility":2},{"url":"https://cryptopotato.com/another-defi-hack-7-7-million-stolen-in-a-flash-loan-attack-from-warp-finance/","name":"Another DeFi Hack: $7.7 Million Stolen in a Flash Loan Attack from Warp Finance — CryptoPotato","type":"news_article","credibility":2},{"url":"https://smartcontractshacking.com/hacks/warp-finance-hack-2020","name":"Warp Finance Hack (2020) — $7.8M Lost | Smart Contract Hacking","type":"research","credibility":2},{"url":"https://etherscan.io/address/0xdf8bee861227ffc5eea819c332a1c170ae3dbacb","name":"Exploit Contract Address — Etherscan","type":"on_chain","credibility":1}],"severity":"critical"},{"content":"The root cause of the exploit was Warp Finance's reliance on a Uniswap AMM spot price to determine the value of LP tokens used as collateral. The protocol calculated LP token value using the formula: (WETH_amount × WETH_price + DAI_amount × DAI_price) / total_LP_supply. While Warp Finance attempted to use a time-weighted average price (TWAP) mechanism for individual token prices — which cannot be manipulated within a single block — it failed to protect against manipulation of the underlying pool reserve quantities. Because LP token value is a function of pool reserves, a large single-block swap could inflate the numerator of the formula even while the per-token prices remained accurate, causing the reported LP token value to roughly double. This class of vulnerability, wherein a lending protocol's oracle can be manipulated by transiently altering an AMM pool's reserve composition through flash loans, had been identified in prior incidents across the DeFi ecosystem. PeckShield and SlowMist both published post-mortems confirming this as the proximate cause. The vulnerability also made standard liquidation of the attacker's undercollateralized position impossible after the fact, since the oracle could not be corrected retroactively within the same transaction.","heading":"Oracle Vulnerability: LP Token Price Manipulation","sources":[{"url":"https://peckshield.medium.com/warpfinance-incident-root-cause-analysis-581a4869ee00","name":"WarpFinance Incident: Root Cause Analysis — PeckShield","type":"research","credibility":2},{"url":"https://slowmist.medium.com/analysis-of-warp-finance-hacked-incident-cb12a1af74cc","name":"Analysis of Warp Finance Hacked Incident — SlowMist","type":"research","credibility":2},{"url":"https://cryptobriefing.com/defi-hackers-millions-flash-loan-attack/","name":"DeFi Hackers Bag More Millions in Another Flash Loan Attack — Crypto Briefing","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Following the exploit, Warp Finance's team worked with members of the white-hat security community — including researchers identified in communications as Emiliano, Banteg, Samczsun, and Julien Bouteloup — to assess the damage and secure remaining assets. Because the attacker's flash loan had been repaid but the LP token collateral used to obtain the loans remained locked in WarpVaultLP, the team was able to recover that collateral. On December 20, 2020 at approximately 02:16 UTC, the team announced it had successfully secured the exploiter's collateral in the form of ETH/DAI-LP tokens, valued at approximately $5.688 million — roughly 73–75% of the stolen amount. These recovered tokens were distributed proportionally to affected depositors within 24 hours. For the remaining approximately $2 million in unrecovered stablecoins still held by the attacker, Warp Finance introduced a 'Portal IOU' token with a total supply of 7,816,976 tokens, each redeemable for 0.001449697206 Warp (WARP) governance tokens at the protocol's planned token generation event, representing approximately 7.5% of total WARP supply. Users who held Portal IOU tokens until the end of a six-month vesting period were eligible for additional bonus WARP tokens. The stolen stablecoins themselves were not returned by the attacker; no confirmed bug bounty payment to the attacker has been documented in primary sources.","heading":"Fund Recovery and User Compensation","sources":[{"url":"https://decrypt.co/52125/warp-finance-recovers-5-8-million-days-after-hack","name":"Warp Finance Recovers $5.8 Million Days After Hack — Decrypt","type":"news_article","credibility":2},{"url":"https://warpfinance.medium.com/warp-finance-exploit-summary-recovery-of-funds-5b8fe4a11898","name":"Warp Finance — Exploit Summary & Recovery of Funds (Official Medium)","type":"official","credibility":2},{"url":"https://warpfinance.medium.com/warp-finance-reimburses-users-with-its-portal-iou-token-10016812fc84","name":"Further Clarification: Warp Finance Reimburses Users with its Portal IOU Token (Official Medium)","type":"official","credibility":2},{"url":"https://cointelegraph.com/news/after-exploit-warp-finance-compensation-plan-takes-promising-strides","name":"After Exploit, Warp Finance Compensation Plan Takes Promising Strides — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://www.quadrigainitiative.com/casestudy/warpfinancehack.php","name":"Dec 2020 — Warp Finance Hack — Quadriga Initiative Case Study","type":"research","credibility":2}],"severity":"high"},{"content":"Warp Finance relaunched on approximately February 9, 2021, following a security audit conducted by n-Var. The primary remediation was the replacement of the Uniswap AMM spot-price oracle with Chainlink decentralized price feeds, which aggregate prices from numerous off-chain data sources and are not manipulable within a single block transaction. The protocol integrated Chainlink price feeds for DAI/ETH, BTC/ETH, USDT/ETH, and USDC/ETH pairs. The LP token valuation formula was also revised to use these manipulation-resistant reference prices rather than real-time Uniswap reserves. A Warp V2 bug bounty program was subsequently established through Immunefi. The relaunch was accompanied by a community outreach campaign and user testing period intended to rebuild depositor confidence. The WARP governance token was issued as part of the relaunch plan; its long-term market performance and protocol adoption following the relaunch are not well-documented in publicly available Tier 1 or Tier 2 sources.","heading":"Protocol Relaunch and Security Remediation","sources":[{"url":"https://warpfinance.medium.com/warp-finance-will-integrate-chainlink-price-feeds-to-secure-protocol-relaunch-2108666d3830","name":"Warp Finance Relaunches with Additional Security Measures — Chainlink Integration (Official Medium)","type":"official","credibility":2},{"url":"https://beincrypto.com/warp-finance-relaunches-additional-security-chainlink/","name":"Warp Finance Relaunches with Additional Security — BeInCrypto","type":"news_article","credibility":2},{"url":"https://bitcoinist.com/warp-finance-re-launches-after-reimbursement-of-hacked-stablecoins/","name":"Warp Finance Re-Launches After Reimbursement of Hacked Stablecoins — Bitcoinist","type":"news_article","credibility":2},{"url":"https://warpfinance.medium.com/warp-v2-bug-bounty-program-with-immunefi-6fefb23d98ac","name":"Warp V2 Bug Bounty Program with Immunefi (Official Medium)","type":"official","credibility":2}],"severity":"medium"},{"content":"The Warp Finance incident occurred during a period of rapid DeFi expansion in late 2020, when flash loan attacks exploiting AMM-based oracles had already claimed tens of millions of dollars across protocols including bZx, Harvest Finance, and Value DeFi. The specific attack vector — using flash loans to manipulate Uniswap spot prices used as collateral oracles — was not novel at the time of the Warp Finance exploit, raising questions about the protocol's pre-launch security practices. Security researchers noted that the absence of an audit prior to launch, combined with acceptance of LP tokens (whose value is especially sensitive to reserve manipulation) as collateral, created compounded risk. The incident reinforced industry guidance that protocols accepting AMM-derived price data must use time-weighted average prices (TWAPs) over sufficiently long windows, or preferably off-chain aggregated feeds such as Chainlink, to resist single-block manipulation. Warp Finance's own post-mortem stated: 'Smart contracts are not provably secure.' The case is frequently cited in DeFi security curricula as an illustrative example of LP token oracle risk.","heading":"Broader Context: DeFi Oracle Risk and Industry Lessons","sources":[{"url":"https://peckshield.medium.com/warpfinance-incident-root-cause-analysis-581a4869ee00","name":"WarpFinance Incident: Root Cause Analysis — PeckShield","type":"research","credibility":2},{"url":"https://smartcontractshacking.com/hacks/warp-finance-hack-2020","name":"Warp Finance Hack (2020) — $7.8M Lost | Smart Contract Hacking","type":"research","credibility":2},{"url":"https://www.financemagnates.com/cryptocurrency/news/newly-launched-warp-finance-lost-8-million-in-flash-loan-attack/","name":"Newly Launched Warp Finance Lost $8 Million in Flash Loan Attack — Finance Magnates","type":"news_article","credibility":2}],"severity":"high"}],"timeline":[{"date":"2020-12-09","event":"Warp Finance protocol launches on Ethereum mainnet, offering stablecoin loans collateralized by Uniswap LP tokens. No pre-launch security audit had been completed.","source":"CoinDesk / Warp Finance Medium","source_url":"https://www.coindesk.com/markets/2020/12/18/warp-finance-suffers-possible-8m-flash-loan-attack"},{"date":"2020-12-17","event":"At approximately 02:30 UTC, an unidentified attacker executes a multi-step flash loan attack. The attacker borrows ~2.9M DAI and ~344,800 WETH via flash loans from dYdX and Uniswap V2, deposits DAI to mint ~94,349 LP tokens as collateral, manipulates the Uniswap WETH-DAI pool reserve ratio to approximately double the reported LP token value, and borrows 3.86M DAI and 3.9M USDC (~$7.76M total) against the inflated collateral.","source":"PeckShield Root Cause Analysis","source_url":"https://peckshield.medium.com/warpfinance-incident-root-cause-analysis-581a4869ee00"},{"date":"2020-12-18","event":"Warp Finance team publicly acknowledges the exploit via Twitter, stating it is 'investigating irregular stablecoin loans.' CoinDesk and other outlets report the incident. Protocol deposits are suspended.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2020/12/18/warp-finance-suffers-possible-8m-flash-loan-attack"},{"date":"2020-12-18","event":"PeckShield and SlowMist publish independent root cause analyses identifying the Uniswap AMM-based LP token oracle as the exploited vulnerability.","source":"PeckShield Medium / SlowMist Medium","source_url":"https://peckshield.medium.com/warpfinance-incident-root-cause-analysis-581a4869ee00"},{"date":"2020-12-20","event":"At 02:16 UTC, Warp Finance announces recovery of the exploiter's locked ETH/DAI-LP token collateral (~$5.688M, approximately 73–75% of lost funds) with assistance from white-hat researchers including Emiliano, Banteg, Samczsun, and Julien Bouteloup. Distribution to affected users is planned within 24 hours.","source":"Warp Finance Medium / Decrypt","source_url":"https://decrypt.co/52125/warp-finance-recovers-5-8-million-days-after-hack"},{"date":"2020-12-22","event":"Recovered ETH/DAI-LP tokens (~$5.688M) distributed proportionally to affected depositors. The remaining ~$2M in stablecoins held by the attacker is not recovered.","source":"Quadriga Initiative Case Study","source_url":"https://www.quadrigainitiative.com/casestudy/warpfinancehack.php"},{"date":"2021-01","event":"Warp Finance announces the Portal IOU token compensation plan: 7,816,976 Portal IOU tokens issued to affected users, redeemable for WARP governance tokens at the planned token generation event, representing approximately 7.5% of total WARP supply.","source":"Warp Finance Medium (Portal IOU clarification post)","source_url":"https://warpfinance.medium.com/warp-finance-reimburses-users-with-its-portal-iou-token-10016812fc84"},{"date":"2021-01","event":"Warp Finance announces integration of Chainlink price feeds (DAI/ETH, BTC/ETH, USDT/ETH, USDC/ETH) to replace the vulnerable Uniswap AMM oracle for the forthcoming relaunch.","source":"Warp Finance Medium (Chainlink integration announcement)","source_url":"https://warpfinance.medium.com/warp-finance-will-integrate-chainlink-price-feeds-to-secure-protocol-relaunch-2108666d3830"},{"date":"2021-02-09","event":"Warp Finance relaunches as Warp V2 following a security audit by n-Var, with Chainlink oracle integration and revised LP token valuation logic. A bug bounty program is subsequently established via Immunefi.","source":"Bitcoinist / BeInCrypto","source_url":"https://bitcoinist.com/warp-finance-re-launches-after-reimbursement-of-hacked-stablecoins/"}],"sources_used":[{"url":"https://warpfinance.medium.com/warp-finance-exploit-summary-recovery-of-funds-5b8fe4a11898","name":"Warp Finance — Exploit Summary & Recovery of Funds (Official Medium)","type":"official","archive_url":"https://web.archive.org/web/20260724233320/https://warpfinance.medium.com/warp-finance-exploit-summary-recovery-of-funds-5b8fe4a11898","credibility":2,"archive_timestamp":"2026-07-24T23:33:20+00:00"},{"url":"https://peckshield.medium.com/warpfinance-incident-root-cause-analysis-581a4869ee00","name":"WarpFinance Incident: Root Cause Analysis — PeckShield","type":"research","archive_url":"http://web.archive.org/web/20250804101428/https://peckshield.medium.com/warpfinance-incident-root-cause-analysis-581a4869ee00","credibility":2,"archive_timestamp":"2025-08-04T10:14:28+00:00"},{"url":"https://slowmist.medium.com/analysis-of-warp-finance-hacked-incident-cb12a1af74cc","name":"Analysis of Warp Finance Hacked Incident — SlowMist","type":"research","archive_url":"http://web.archive.org/web/20250909134758/https://slowmist.medium.com/analysis-of-warp-finance-hacked-incident-cb12a1af74cc","credibility":2,"archive_timestamp":"2025-09-09T13:47:58+00:00"},{"url":"https://www.coindesk.com/markets/2020/12/18/warp-finance-suffers-possible-8m-flash-loan-attack","name":"Warp Finance Suffers Possible $8M Flash Loan Attack — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260724182908/https://www.coindesk.com/markets/2020/12/18/warp-finance-suffers-possible-8m-flash-loan-attack","credibility":1,"archive_timestamp":"2026-07-24T18:29:08+00:00"},{"url":"https://decrypt.co/52125/warp-finance-recovers-5-8-million-days-after-hack","name":"Warp Finance Recovers $5.8 Million Days After Hack — Decrypt","type":"news_article","archive_url":"http://web.archive.org/web/20260215135737/https://decrypt.co/52125/warp-finance-recovers-5-8-million-days-after-hack","credibility":2,"archive_timestamp":"2026-02-15T13:57:37+00:00"},{"url":"https://cryptopotato.com/another-defi-hack-7-7-million-stolen-in-a-flash-loan-attack-from-warp-finance/","name":"Another DeFi Hack: $7.7 Million Stolen in a Flash Loan Attack — CryptoPotato","type":"news_article","archive_url":"https://web.archive.org/web/20260724222940/https://cryptopotato.com/another-defi-hack-7-7-million-stolen-in-a-flash-loan-attack-from-warp-finance/","credibility":2,"archive_timestamp":"2026-07-24T22:29:40+00:00"},{"url":"https://cryptobriefing.com/defi-hackers-millions-flash-loan-attack/","name":"DeFi Hackers Bag More Millions in Another Flash Loan Attack — Crypto Briefing","type":"news_article","archive_url":"http://web.archive.org/web/20251111204941/https://cryptobriefing.com/defi-hackers-millions-flash-loan-attack/","credibility":2,"archive_timestamp":"2025-11-11T20:49:41+00:00"},{"url":"https://cointelegraph.com/news/after-exploit-warp-finance-compensation-plan-takes-promising-strides","name":"After Exploit, Warp Finance Compensation Plan Takes Promising Strides — CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20260418013203/https://cointelegraph.com/news/after-exploit-warp-finance-compensation-plan-takes-promising-strides","credibility":2,"archive_timestamp":"2026-04-18T01:32:03+00:00"},{"url":"https://beincrypto.com/warp-finance-relaunches-additional-security-chainlink/","name":"Warp Finance Relaunches With Additional Security from Chainlink — BeInCrypto","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://bitcoinist.com/warp-finance-re-launches-after-reimbursement-of-hacked-stablecoins/","name":"Warp Finance Re-Launches After Reimbursement of Hacked Stablecoins — Bitcoinist","type":"news_article","archive_url":"http://web.archive.org/web/20260726134219/https://bitcoinist.com/warp-finance-re-launches-after-reimbursement-of-hacked-stablecoins/","credibility":2,"archive_timestamp":"2026-07-26T13:42:19+00:00"},{"url":"https://warpfinance.medium.com/warp-finance-reimburses-users-with-its-portal-iou-token-10016812fc84","name":"Further Clarification: Warp Finance Reimburses Users with its Portal IOU Token (Official Medium)","type":"official","archive_url":"https://web.archive.org/web/20260724233338/https://warpfinance.medium.com/warp-finance-reimburses-users-with-its-portal-iou-token-10016812fc84","credibility":2,"archive_timestamp":"2026-07-24T23:33:38+00:00"},{"url":"https://warpfinance.medium.com/warp-finance-will-integrate-chainlink-price-feeds-to-secure-protocol-relaunch-2108666d3830","name":"Warp Finance Will Integrate Chainlink Price Feeds (Official Medium)","type":"official","archive_url":"https://web.archive.org/web/20260724233440/https://warpfinance.medium.com/warp-finance-will-integrate-chainlink-price-feeds-to-secure-protocol-relaunch-2108666d3830","credibility":2,"archive_timestamp":"2026-07-24T23:34:40+00:00"},{"url":"https://warpfinance.medium.com/warp-v2-bug-bounty-program-with-immunefi-6fefb23d98ac","name":"Warp V2 Bug Bounty Program with Immunefi (Official Medium)","type":"official","archive_url":"https://web.archive.org/web/20260726070947/https://warpfinance.medium.com/warp-v2-bug-bounty-program-with-immunefi-6fefb23d98ac","credibility":2,"archive_timestamp":"2026-07-26T07:09:47+00:00"},{"url":"https://smartcontractshacking.com/hacks/warp-finance-hack-2020","name":"Warp Finance Hack (2020) — $7.8M Lost | Smart Contract Hacking","type":"research","archive_url":"https://web.archive.org/web/20260724231742/https://smartcontractshacking.com/hacks/warp-finance-hack-2020","credibility":2,"archive_timestamp":"2026-07-24T23:17:42+00:00"},{"url":"https://www.quadrigainitiative.com/casestudy/warpfinancehack.php","name":"Dec 2020 — Warp Finance Hack — Quadriga Initiative Case Study","type":"research","archive_url":"http://web.archive.org/web/20251116180336/https://quadrigainitiative.com/casestudy/warpfinancehack.php","credibility":2,"archive_timestamp":"2025-11-16T18:03:36+00:00"},{"url":"https://www.financemagnates.com/cryptocurrency/news/newly-launched-warp-finance-lost-8-million-in-flash-loan-attack/","name":"Newly Launched Warp Finance Lost $8 Million in Flash Loan Attack — Finance Magnates","type":"news_article","archive_url":"http://web.archive.org/web/20260725005111/https://www.financemagnates.com/cryptocurrency/news/newly-launched-warp-finance-lost-8-million-in-flash-loan-attack/","credibility":2,"archive_timestamp":"2026-07-25T00:51:11+00:00"},{"url":"https://etherscan.io/address/0xdf8bee861227ffc5eea819c332a1c170ae3dbacb","name":"Exploit Contract Address 0xdf8bee861227ffc5eea819c332a1c170ae3dbacb — Etherscan","type":"on_chain","archive_url":"http://web.archive.org/web/20260410131048/https://etherscan.io/address/0xdf8bee861227ffc5eea819c332a1c170ae3dbacb","credibility":1,"archive_timestamp":"2026-04-10T13:10:48+00:00"},{"url":"https://coincodex.com/article/10212/warp-finance-loses-77-million-in-latest-defi-exploit/","name":"Warp Finance Loses $7.7 Million in Latest DeFi Exploit — CoinCodex","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:gone","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-5","created_at":"2026-05-30T13:00:24.149555+00:00","updated_at":"2026-08-29T01:33:02.502+00:00"}}