Summary
Raft is a decentralized Ethereum CDP lending protocol that issued the R stablecoin, collateralized by liquid staking tokens (stETH, rETH). On November 10, 2023, an attacker exploited a precision loss vulnerability to mint approximately $6.7 million in unbacked R tokens, draining 1,577 ETH from the protocol and causing the R stablecoin to depeg by up to 50%. Due to a coding error the attacker burned 1,570 of the stolen ETH to an inaccessible burn address, effectively losing money on the attack; the protocol subsequently implemented a partial recovery plan offering approximately 42% restitution to affected users and announced plans to phase out the current version.
Connected Entities
1 entitiesTimeline(11 events)
2021-05-01
David Garai founds Tempus Finance, the parent organization behind Raft.
2022-08-01
Tempus Labs launches Nostra Finance on StarkNet.
2023-03-01
Raft protocol officially announced; enables borrowing of R stablecoin against stETH collateral on Ethereum mainnet.
2023-06-01
Raft deploys to Ethereum mainnet.
2023-07-01
Raft TVL peaks at approximately $64 million.
2023-11-10
Attacker uses flash loan of 6,000 cbETH to exploit precision loss vulnerability, minting ~6.7 million unbacked R tokens and draining 1,577 ETH (~$3.3M). Attacker burns 1,570 ETH by mistake. R stablecoin depegs by up to 50%.
2023-11-10
Raft pauses R stablecoin minting. Co-founder David Garai confirms the attack on X and pledges recovery effort using PSM funds.
2023-11-13
Raft publishes post-mortem report acknowledging audit failures and precision loss root cause.
2024-01-01
Raft finalizes recovery plan offering approximately 42% restitution to affected R stablecoin holders, funded by 3.96 million DAI from the PSM.
2024-03-31
Deadline for affected users to claim funds under the Raft Recovery Plan.
2024-06-01
Protocol TVL has declined to approximately $1.48 million; R stablecoin remains depegged with minimal liquidity.
Decision Log
- hash: FbYVjgafjCeVg3r68hQF2nhCQa5TjToxKXciCU9nBbzQ
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:37 AM
last updated: 5/27/2026, 6:53:47 PM
avoid.net — verified advice for a post-truth world