{"investigation":{"slug":"wise-lending-v2","entity_name":"Wise Lending V2","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Wise Lending V2 is a decentralized lending and yield-farm aggregator protocol deployed on Ethereum and Arbitrum that allows users to supply crypto assets and earn variable yields. The protocol suffered two confirmed exploits: a price manipulation attack in October 2023 that caused approximately $260,000 in losses, followed by a more severe flash loan and share-inflation attack on January 12, 2024 that drained approximately $464,000. The January 2024 attack exploited a precision flaw in the protocol's ERC-4626-style share accounting logic, and a subsequent Code4rena audit in February 2024 identified 5 high-severity and 17 medium-severity vulnerabilities in the codebase.","sections":[{"content":"Wise Lending V2 is a fully decentralized liquidity market and yield-farm aggregator built on Ethereum, with additional deployment on Arbitrum. The protocol allows users to supply crypto assets and earn a variable annual percentage yield (APY) derived from borrower demand. Wise Lending also offers low-risk, like-kind-asset leverage options for yield farming in stablecoins and ETH. A distinguishing feature of the V2 architecture is integration with Pendle Finance LP tokens as collateral, enabling exposure to yield-bearing assets such as Pendle LP stETH (PLP-stETH). According to DeFiLlama, as of 2025 the protocol held approximately $28.15 million in total value locked (TVL), split between $25.34 million on Ethereum and $2.81 million on Arbitrum. The protocol describes its contracts as immutable and claims to be secured by independent auditors. Wise Lending V1 operates separately from V2 and is tracked independently on chain analytics platforms.","heading":"Protocol Overview","sources":[{"url":"https://wiselending.com/","name":"wiselending.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/wise-lending-v2","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On January 12, 2024, at approximately 19:29 UTC, Wise Lending V2 suffered a flash loan attack that drained approximately 177 ETH, valued at roughly $464,000 at the time. The attacker's contract address ended in 'd82c' (full address: 0x91c49cc7fbfe8f70aceeb075952cd64817f9d82c), and the vulnerable contract was 0x37e49bf3749513a02fa535f0cbc383796e8107e4. The attack transaction hash is 0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31.\n\nBlockchain security firm PeckShield attributed the exploit to a precision flaw in the protocol's share accounting logic. The attacker exploited a nearly empty PLP-stETH-Dec2025 pool by executing a 'rounding donation attack': a minimal initial deposit was followed by a donation approximately 5,000,000 times larger than the deposit, just below the protocol's throttle limit. This discrepancy between pseudoTotalPool and totalDepositShares — caused by rounding up during share burning — progressively inflated the per-share exchange rate. The attacker then deposited tokens to obtain 6 shares, created 6 puppet contracts each holding 1 share, used the inflated shares as collateral to borrow USDC, WETH, USDT, DAI, and multiple Pendle Finance-associated tokens, and finally drained the pool by burning shares at artificially elevated valuations.\n\nThe attack also involved borrowing 1,110 Lido Staked Ether (stETH) tokens worth approximately $2.9 million from the Aave lending protocol. Security researcher @officer_cia noted a 7% price swing between stETH and ETH within a specific pool, potentially exacerbated by an Aave V2 stETH flash loan. Specific tokens drained included approximately $9,000 USDC, $2,000 USDT, $5,000 DAI, 18.51 WETH (~$47,694), and numerous Pendle Finance LP tokens. Wise Lending did not immediately respond to media requests for comment following the incident.","heading":"January 2024 Flash Loan and Share-Inflation Exploit","sources":[{"url":"https://blog.solidityscan.com/wise-lending-hack-analysis-f652f389e397","name":"blog.solidityscan.com","type":"other","credibility":3},{"url":"https://medium.com/@astrasec/wiselending-hack-root-cause-analysis-1a2762f52298","name":"medium.com","type":"other","credibility":3},{"url":"https://www.fxstreet.com/cryptocurrencies/news/wise-lending-market-exploited-for-177-eth-in-a-flash-loan-attack-202401130252","name":"fxstreet.com","type":"other","credibility":3},{"url":"https://coincodecap.com/wise-lending-faces-440k-loss-in-suspected-flash-loan-exploit-of-crypto-assets","name":"coincodecap.com","type":"other","credibility":3},{"url":"https://www.infect3d.xyz/blog/wise-lending-post-mortem","name":"infect3d.xyz","type":"other","credibility":3}],"severity":"medium"},{"content":"On October 13, 2023, Wise Lending suffered an earlier price manipulation attack resulting in an alleged loss of approximately $260,000. This incident preceded the larger January 2024 exploit and was described by multiple outlets as the first confirmed attack on the protocol. Multiple subsequent reports on the January 2024 exploit noted it marked 'the second attack on the protocol within six months,' confirming the October 2023 incident as a prior security failure. The specific technical mechanism of the October 2023 attack was not as thoroughly documented in the public record as the January 2024 event, but oracle price manipulation via flash loans was the suspected vector. The recurrence of a similar attack class within six months raises questions about whether adequate remediation was undertaken after the first incident.","heading":"October 2023 Price Manipulation Attack","sources":[{"url":"https://cointelegraph.com/news/wise-lending-drained-440k-crypto-apparent-flash-loan-exploit","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://coincodecap.com/wise-lending-faces-440k-loss-in-suspected-flash-loan-exploit-of-crypto-assets","name":"coincodecap.com","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/62124-wise-lending-loses-400000-flash-loan-attack","name":"cryptorank.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the January 2024 exploit, Wise Lending sponsored a competitive security audit through Code4rena (C4), running from February 21 to March 11, 2024. The audit scope covered 44 smart contracts comprising 6,326 lines of Solidity code, with $200,000 USDC in bounty rewards across 19 days. The audit identified a total of 22 unique vulnerabilities: 5 classified as HIGH severity, 17 as MEDIUM severity, and 7 as LOW severity or non-critical. The existence of 5 high-severity findings in the audited codebase — conducted after the protocol had already been exploited twice — indicates material unresolved risk in the contract logic. The full audit report is publicly available on Code4rena. A separate GitHub repository (code-423n4/2024-02-wise-lending) contains the static analysis report ('4naly3er-report.md') and contract source files submitted for review.","heading":"Code4rena Security Audit Findings (February 2024)","sources":[{"url":"https://code4rena.com/reports/2024-02-wise-lending","name":"code4rena.com","type":"other","credibility":3},{"url":"https://code4rena.com/audits/2024-02-wise-lending","name":"code4rena.com","type":"other","credibility":3},{"url":"https://github.com/code-423n4/2024-02-wise-lending","name":"github.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The January 2024 exploit belongs to a class of attacks known as ERC-4626 or vault share inflation attacks, also sometimes called 'first depositor' or 'donation attacks.' The core vulnerability arises when a vault-style lending pool is nearly empty and a malicious actor can manipulate the exchange rate between underlying tokens and vault shares through strategic donations.\n\nIn Wise Lending V2's case, the root cause was a precision loss bug in the _calculateShares function. As documented by SolidityScan and the AstraSec team, rounding occurs when burning shares, causing the pseudoTotalPool value (the virtual token balance) to diverge from totalDepositShares (the number of shares). By donating just below the protocol's throttle limit, the attacker exploited this discrepancy to make a small number of shares appear to represent an enormous quantity of underlying tokens.\n\nMitigation strategies identified by post-incident researchers include: (1) minting and permanently locking a small number of 'dead shares' when a pool is first created, as practiced by Uniswap V2; (2) performing all multiplication before division in share calculations to avoid precision loss; (3) implementing slippage controls for share price fluctuations; and (4) ensuring governance deposits occur simultaneously with pool activation to prevent empty-pool exploitation windows. The February 2024 Code4rena audit reinforced the recommendation to enforce non-empty pool invariants.","heading":"Technical Vulnerability Pattern: ERC-4626 Share Inflation","sources":[{"url":"https://blog.solidityscan.com/wise-lending-hack-analysis-f652f389e397","name":"blog.solidityscan.com","type":"other","credibility":3},{"url":"https://medium.com/@astrasec/wiselending-hack-root-cause-analysis-1a2762f52298","name":"medium.com","type":"other","credibility":3},{"url":"https://www.infect3d.xyz/blog/wise-lending-post-mortem","name":"infect3d.xyz","type":"other","credibility":3},{"url":"https://code4rena.com/reports/2024-02-wise-lending","name":"code4rena.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Wise Lending V2 has been flagged as a notable security risk entity by on-chain investigation communities, including attribution by ZachXBT, a pseudonymous blockchain investigator with a strong track record of identifying DeFi exploits and fraud. The protocol has suffered two confirmed exploits within a six-month window (October 2023 and January 2024), totaling an estimated $720,000+ in user losses. A third alleged incident involving a $66,000 flash loan exploit affecting both the Arbitrum and Ethereum deployments is listed in DeFiLlama's hack tracker, attributed to February 28, 2026, though corroborating news coverage of this third incident was not independently confirmed in available sources at the time of this investigation.\n\nThe protocol's claim that its contracts are 'immutable and secured by the best auditors' is contradicted by the post-audit discovery of 5 high-severity vulnerabilities in the Code4rena review and by the recurrence of exploits both before and after public audits. As of the most recent available data, the protocol continues to operate with approximately $28 million TVL but reports zero active loans and near-zero fees, suggesting significantly reduced user activity following the security incidents. No public post-mortem or formal incident response from the Wise Lending team has been located in indexed sources.","heading":"Protocol Risk Profile and Community Flags","sources":[{"url":"https://defillama.com/protocol/wise-lending-v2","name":"defillama.com","type":"other","credibility":3},{"url":"https://code4rena.com/reports/2024-02-wise-lending","name":"code4rena.com","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/62124-wise-lending-loses-400000-flash-loan-attack","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://coinpaper.com/3049/major-incidents-from-last-week-wise-lending-exploit-and-xai-token-rug-pull","name":"coinpaper.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2023-10-13","event":"Wise Lending suffers its first confirmed exploit — a price manipulation attack — resulting in approximately $260,000 in losses.","source":""},{"date":"2024-01-12","event":"Wise Lending V2 exploited via flash loan and ERC-4626 share inflation attack. Approximately 177 ETH (~$464,000) drained from the PLP-stETH-Dec2025 pool. Attacker contract: 0x91c49cc7fbfe8f70aceeb075952cd64817f9d82c. Exploit first reported on-chain by researcher Spreek.","source":""},{"date":"2024-02-21","event":"Code4rena competitive audit of Wise Lending V2 begins, covering 44 smart contracts and 6,326 lines of Solidity.","source":""},{"date":"2024-03-11","event":"Code4rena audit concludes. Report identifies 5 HIGH-severity and 17 MEDIUM-severity vulnerabilities.","source":""},{"date":"2024-03-11","event":"Code4rena audit report for Wise Lending V2 published, detailing 22 unique vulnerabilities in the protocol codebase.","source":""},{"date":"2026-02-28","event":"A $66,000 flash loan exploit affecting Wise Lending V2 on both Arbitrum and Ethereum chains is recorded by DeFiLlama's hack tracker. Independent news confirmation was not located at time of investigation.","source":""}],"sources_used":[{"url":"https://wiselending.com/","name":"wiselending.com","type":"other","archive_url":"http://web.archive.org/web/20260704121556/https://wiselending.com/","credibility":3,"archive_timestamp":"2026-07-04T12:15:56+00:00"},{"url":"https://defillama.com/protocol/wise-lending-v2","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250906123823/https://defillama.com/protocol/wise-lending-v2","credibility":3,"archive_timestamp":"2025-09-06T12:38:23+00:00"},{"url":"https://blog.solidityscan.com/wise-lending-hack-analysis-f652f389e397","name":"blog.solidityscan.com","type":"other","archive_url":"http://web.archive.org/web/20260419231740/https://blog.solidityscan.com/wise-lending-hack-analysis-f652f389e397/","credibility":3,"archive_timestamp":"2026-04-19T23:17:40+00:00"},{"url":"https://medium.com/@astrasec/wiselending-hack-root-cause-analysis-1a2762f52298","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.fxstreet.com/cryptocurrencies/news/wise-lending-market-exploited-for-177-eth-in-a-flash-loan-attack-202401130252","name":"fxstreet.com","type":"other","archive_url":"https://web.archive.org/web/20260829122227/https://www.fxstreet.com/cryptocurrencies/news/wise-lending-market-exploited-for-177-eth-in-a-flash-loan-attack-202401130252","credibility":3,"archive_timestamp":"2026-08-29T12:22:27+00:00"},{"url":"https://coincodecap.com/wise-lending-faces-440k-loss-in-suspected-flash-loan-exploit-of-crypto-assets","name":"coincodecap.com","type":"other","archive_url":"http://web.archive.org/web/20251208215032/https://coincodecap.com/wise-lending-faces-440k-loss-in-suspected-flash-loan-exploit-of-crypto-assets","credibility":3,"archive_timestamp":"2025-12-08T21:50:32+00:00"},{"url":"https://www.infect3d.xyz/blog/wise-lending-post-mortem","name":"infect3d.xyz","type":"other","archive_url":"http://web.archive.org/web/20260609144316/https://www.infect3d.xyz/blog/wise-lending-post-mortem","credibility":3,"archive_timestamp":"2026-06-09T14:43:16+00:00"},{"url":"https://cointelegraph.com/news/wise-lending-drained-440k-crypto-apparent-flash-loan-exploit","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260123143009/https://cointelegraph.com/news/wise-lending-drained-440k-crypto-apparent-flash-loan-exploit","credibility":3,"archive_timestamp":"2026-01-23T14:30:09+00:00"},{"url":"https://cryptorank.io/news/feed/62124-wise-lending-loses-400000-flash-loan-attack","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260829114041/https://cryptorank.io/news/feed/62124-wise-lending-loses-400000-flash-loan-attack","credibility":3,"archive_timestamp":"2026-08-29T11:40:41+00:00"},{"url":"https://code4rena.com/reports/2024-02-wise-lending","name":"code4rena.com","type":"other","archive_url":"http://web.archive.org/web/20260308140210/https://code4rena.com/reports/2024-02-wise-lending","credibility":3,"archive_timestamp":"2026-03-08T14:02:10+00:00"},{"url":"https://code4rena.com/audits/2024-02-wise-lending","name":"code4rena.com","type":"other","archive_url":"http://web.archive.org/web/20260704121558/https://code4rena.com/audits/2024-02-wise-lending","credibility":3,"archive_timestamp":"2026-07-04T12:15:58+00:00"},{"url":"https://github.com/code-423n4/2024-02-wise-lending","name":"github.com","type":"other","archive_url":"http://web.archive.org/web/20251207181806/https://github.com/code-423n4/2024-02-wise-lending","credibility":3,"archive_timestamp":"2025-12-07T18:18:06+00:00"},{"url":"https://coinpaper.com/3049/major-incidents-from-last-week-wise-lending-exploit-and-xai-token-rug-pull","name":"coinpaper.com","type":"other","archive_url":"http://web.archive.org/web/20260417114912/https://coinpaper.com/3049/major-incidents-from-last-week-wise-lending-exploit-and-xai-token-rug-pull","credibility":3,"archive_timestamp":"2026-04-17T11:49:12+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:13.167211+00:00","updated_at":"2026-08-29T12:34:15.173981+00:00"}}