Audit log

Every state-changing event for ResupplyFi: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-02 12:14:44Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   2HyQEkVdajbA…1advkpH4copysha256 → base58

   verifying row…

   canonical bytes (22555 B) ▸

   {"actor":"system:backfill","investigation_id":"4bb58024-57a7-40e3-a513-fb70b841b377","kind":"publish","page_slug":"resupplyfi","published_at":"2026-08-02T12:14:44.024Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"ResupplyFi","sections":[{"content":"ResupplyFi (resupply.finance) is a decentralized stablecoin protocol that allows users to borrow its native stablecoin, reUSD, against yield-bearing stablecoin positions — primarily from Curve Lend (LlamaLend) and Fraxlend. The protocol was conceived in December 2024 and officially launched on March 20, 2025. It operates as a subDAO developed jointly by Convex Finance and Yearn Finance. Collateral positions deposited into Resupply are automatically staked on Convex Finance, earning users additional boosted rewards in CRV and CVX. Protocol fees are distributed to RSUP stakers, the protocol's insurance pool, and the Resupply treasury. RSUP has no maximum supply and follows an inflation schedule, with initial emission allocations of 50% for voting incentives, 25% for the insurance pool, and 25% for CDPs. In its first week of operation, the protocol generated approximately $44,700 in fees, with $35 million in reUSD minted backed by $42 million in collateral. Prior to the June 2025 exploit, total value locked reached approximately $135–136 million.","heading":"Protocol Overview","severity":"low","sources":[{"credibility":2,"name":"Convex and Yearn Launch Resupply Protocol with Yield-Bearing Stablecoin reUSD","type":"news_article","url":"https://outposts.io/article/convex-and-yearn-launch-resupply-protocol-with-yield-bearing-dc94dbfb-4331-49ee-bde9-7c77b71c24cf"},{"credibility":2,"name":"Resupply — Projects & Protocols | IQ.wiki","type":"other","url":"https://iq.wiki/wiki/resupply"},{"credibility":1,"name":"Resupply Official Website","type":"official","url":"https://resupply.finance/"}]},{"content":"On June 25–26, 2025, ResupplyFi suffered a critical exploit against its newly deployed crvUSD-wstUSR lending pair, resulting in the theft of approximately $9.3 to $9.8 million. The affected vault had been deployed only two hours before the attack was executed. The attacker initially received funding via Tornado Cash and deployed two specialized exploit contracts. The attack exploited a classic ERC-4626 'first donation' vulnerability combined with an integer division flaw in the ResupplyPair's exchange rate calculation. The attacker deposited 1 wei into the nearly-empty cvcrvUSD vault, then donated approximately 2,000 crvUSD to the vault, artificially inflating the vault's share price to an extreme level. This caused the exchange rate calculation — computed as 1e36 divided by the oracle price — to round down to zero via Solidity's floor division. As a result, the protocol's solvency check, which computed loan-to-value as borrowAmount multiplied by zero, always evaluated to zero and thus always passed. The attacker was then able to borrow $10 million in reUSD — the entire available protocol liquidity — against just 1 wei of collateral. The vulnerable code patterns are located in ResupplyPairCore.sol at lines 573 (exchange rate), 155–156 (ERC-4626 collateral acceptance), and 282 (solvency check). The exploit transaction is recorded on-chain at hash 0xffbbd492e0605a8bb6d490c3cd879e87ff60862b0684160d08fd5711e7a872d3. The primary attacker address identified is 0x6D9f6E900ac2CE6770Fd9f04f98B7B0fc355E2EA. Stolen funds were converted to ETH and split across two secondary addresses holding approximately $5.5 million and $3.9 million respectively. The attacker subsequently routed approximately 2,280 ETH (valued at roughly $9.8 million) and a reported 1,607 ETH (approximately $6.5 million at that time) through Tornado Cash. Following the exploit, total value locked in the protocol fell from approximately $135–136 million to $78–85 million as users withdrew funds.","heading":"June 2025 Exploit — ERC-4626 First-Donation Attack","severity":"critical","sources":[{"credibility":2,"name":"ResupplyFi Rekt — Rekt News","type":"news_article","url":"https://rekt.news/resupplyfi-rekt"},{"credibility":2,"name":"ResupplyFi Hack Analysis — Ackee Blockchain","type":"research","url":"https://ackee.xyz/blog/resupply-hack-analysis/"},{"credibility":2,"name":"DeFi stablecoin lending protocol Resupply hit with $9.3m exploit — DL News","type":"news_article","url":"https://www.dlnews.com/articles/defi/defi-stablecoin-lending-protocol-resupply-hit-with-93m-exploit/"},{"credibility":2,"name":"Hacker Exploits ResupplyFi Bug to Steal $9.6M in Crypto — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2025/06/26/hacker-exploits-resupplyfi-bug-to-steal-9-6m-in-crypto/"},{"credibility":2,"name":"Hacker Drains $9.6 Million From DeFi Stablecoin Protocol Resupply — Decrypt","type":"news_article","url":"https://decrypt.co/327148/hacker-drained-9-6-million-from-defi-stablecoin-protocol-resupply"},{"credibility":2,"name":"The Resupply attacker has deposited 1,607 ETH into Tornado Cash — PANews","type":"news_article","url":"https://www.panewslab.com/en/articles/caa3441e-5a92-415f-b8b7-81b54052db44"}]},{"content":"ResupplyFi had undergone security reviews by ChainSecurity and yAudit (subsequently rebranded as Electi) approximately three to four months prior to the exploit. Following the attack, both firms initially stated that the exploited market was outside the scope of their audits, as the specific vault had been deployed after their reviews concluded. However, subsequent analysis and a three-way conversation between Rekt News, the audit firms, and ResupplyFi revealed a more complex picture. ChainSecurity acknowledged that 'the code of the vaults which were later deployed were in scope of the audits, the deployment of those vaults and ensuring that they are securely initialized wasn't in scope.' This meant the vulnerable code pattern itself was reviewed, but auditors did not assess the risks associated with deploying and initializing vaults with zero liquidity — precisely the condition that enabled the attack. The audit's trust model assumed that meaningful collateral would be present at deployment, an assumption that was not documented as a requirement or enforced in code. Security researchers from multiple firms including Ackee Blockchain, Halborn, Veridise, and Guardrail subsequently noted that initialization of lending pair contracts — particularly the enforcement of minimum initial liquidity — should be considered a security-critical step that falls within audit scope regardless of deployment timing. Cyvers co-founder Meir Dolev noted the exploit 'could have been prevented with proper input validation, oracle checks, and edge-case testing.'","heading":"Audit Scope Controversy","severity":"high","sources":[{"credibility":2,"name":"ResupplyFi Rekt — Rekt News","type":"news_article","url":"https://rekt.news/resupplyfi-rekt"},{"credibility":2,"name":"ResupplyFi Hack Analysis — Ackee Blockchain","type":"research","url":"https://ackee.xyz/blog/resupply-hack-analysis/"},{"credibility":2,"name":"The ResupplyFi Hack: The Audit Habit That Would Catch It — Veridise","type":"research","url":"https://veridise.com/blog/audit-insights/resupplyfi-hack-audit-habit/"},{"credibility":2,"name":"DeFi stablecoin lending protocol Resupply hit with $9.3m exploit — DL News","type":"news_article","url":"https://www.dlnews.com/articles/defi/defi-stablecoin-lending-protocol-resupply-hit-with-93m-exploit/"}]},{"content":"Following the exploit, the ResupplyFi team paused the affected wstUSR market while the rest of the protocol continued to operate. The team confirmed that only the wstUSR market was impacted. C2tP, a pseudonymous developer affiliated with both Resupply and Convex Finance, contributed $1.4 million of personal funds toward covering user losses. Convex Finance contributed an additional $810,000 from its treasury. Combined with an initial treasury payment of approximately $600,000, over $2.87 million was repaid in the immediate aftermath. The team published a governance proposal on June 30, 2025, outlining a formal recovery plan centered on burning $6 million reUSD from the protocol's insurance pool, which at the time held approximately $38.7 million. This burn, representing approximately 15.5% of the insurance pool's holdings, would cover the majority of outstanding bad debt. The remaining $1.13 million in bad debt was to be carried by the DAO and repaid gradually through protocol fees and RSUP token revenue, with Yearn providing a loan to cover this portion. A shortened three-day governance voting period was proposed in lieu of the standard seven days to expedite the recovery. The proposal drew criticism from Wang Yishi, founder of Onekey hardware wallet, who argued there was no DeFi precedent for using an insurance pool to cover losses from developer-caused bugs. Michael Egorov of Curve defended the approach, stating the exploit was 'not the easiest thing to spot' and that insurance pools are designed for such circumstances. As of August 2025, ResupplyFi announced the full repayment of the $10 million in bad debt, with $8.8 million related to the exploit repaid through the insurance pool burn and contributions, and the remaining $1.13 million covered via the Yearn loan to be repaid through ongoing RSUP staking revenues.","heading":"Recovery Plan and Bad Debt Repayment","severity":"high","sources":[{"credibility":2,"name":"Resupply developer donates $1.4m after protocol suffers $9m exploit — DL News","type":"news_article","url":"https://www.dlnews.com/articles/defi/resupply-developer-donates-funds-after-9m-exploit/"},{"credibility":2,"name":"Stablecoin protocol Resupply proposes burning 6 million tokens after $10 million exploit — The Block","type":"news_article","url":"https://www.theblock.co/post/360226/resupply-six-million-burn"},{"credibility":2,"name":"Resupply protocol outlines recovery plan post $10M exploit, proposes $6M token burn — crypto.news","type":"news_article","url":"https://crypto.news/resupply-protocol-outlines-recovery-plan-post-10m-exploit-proposes-6m-token-burn/"},{"credibility":2,"name":"Resupply Plans 6M reUSD Token Burn to Recover From $10M Hack — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2025/06/30/resupply-plans-6m-reusd-token-burn-to-recover-from-10m-hack/"}]},{"content":"The RSUP token's market capitalization fell to approximately $7 million in the immediate aftermath of the exploit. Total value locked in the protocol declined from approximately $135–136 million before the exploit to $78–85 million, a drop of $50–58 million, reflecting a combination of the direct loss and subsequent user withdrawals driven by reduced confidence. The reUSD stablecoin was put under stress given the $10 million in uncollateralized debt created by the exploit. Insurance pool withdrawals were paused following the attack and only made eligible to resume after the governance-approved recovery plan was enacted within the original seven-day cooldown window.","heading":"Market and Token Impact","severity":"high","sources":[{"credibility":2,"name":"DeFi stablecoin lending protocol Resupply hit with $9.3m exploit — DL News","type":"news_article","url":"https://www.dlnews.com/articles/defi/defi-stablecoin-lending-protocol-resupply-hit-with-93m-exploit/"},{"credibility":2,"name":"ResupplyFi Rekt — Rekt News","type":"news_article","url":"https://rekt.news/resupplyfi-rekt"}]},{"content":"The attacker received initial operational funding through Tornado Cash, a privacy mixer that obscures on-chain fund origins. After executing the exploit and draining $10 million in reUSD, the stolen assets were converted to ETH and distributed across two secondary addresses holding approximately $5.5 million and $3.9 million respectively. The attacker subsequently laundered approximately 2,280 ETH (valued at roughly $9.8 million) and a separately reported 1,607 ETH (approximately $6.5 million) through Tornado Cash. The use of Tornado Cash for both initial funding and proceeds laundering is consistent with patterns observed in other DeFi exploits where attackers seek to obscure the origin and destination of stolen funds. No recovery of funds or identification of the attacker had been publicly confirmed as of the time of this investigation.","heading":"Funds Movement and Tornado Cash Usage","severity":"critical","sources":[{"credibility":3,"name":"ResupplyFi Exploiter Launders $9.8 Million in Stolen ETH Via Tornado Cash","type":"news_article","url":"https://cryptocurrencynewscast.online/resupplyfi-exploiter-launders-9-8-million-in-stolen-eth-via-tornado-cash/"},{"credibility":2,"name":"The Resupply attacker has deposited 1,607 ETH into Tornado Cash — PANews","type":"news_article","url":"https://www.panewslab.com/en/articles/caa3441e-5a92-415f-b8b7-81b54052db44"},{"credibility":2,"name":"ResupplyFi Rekt — Rekt News","type":"news_article","url":"https://rekt.news/resupplyfi-rekt"}]},{"content":"The ResupplyFi exploit is categorized as a variant of the well-documented ERC-4626 inflation or first-donation attack, a class of vulnerability that has affected multiple DeFi protocols. Security researchers noted that the specific combination of an empty vault, absence of a minimum initial liquidity requirement, and an unchecked division operation in the exchange rate formula created the exploitable condition. BlockSec characterized it as 'yet another lending protocol exploited via exchange rate manipulation on low-liquidity — even empty — markets.' Proposed mitigations cited by researchers include enforcing a minimum initial deposit or 'virtual shares' mechanism in vaults to prevent trivial inflation, validating that exchange rates cannot resolve to zero before executing solvency checks, treating deployment initialization as a security-critical step within audit scope, and implementing real-time on-chain monitoring for anomalous borrowing patterns. The exploit occurred in a broader context where crypto hack losses reached $2.1 billion in 2025 according to reporting at the time. The incident added ResupplyFi to the Rekt News leaderboard of significant DeFi exploits.","heading":"Industry Context and Security Lessons","severity":"medium","sources":[{"credibility":2,"name":"ResupplyFi Hack Analysis — Ackee Blockchain","type":"research","url":"https://ackee.xyz/blog/resupply-hack-analysis/"},{"credibility":2,"name":"The ResupplyFi Hack: The Audit Habit That Would Catch It — Veridise","type":"research","url":"https://veridise.com/blog/audit-insights/resupplyfi-hack-audit-habit/"},{"credibility":2,"name":"Lessons from the Resupply exploit — Guardrail","type":"research","url":"https://www.guardrail.ai/blog/resupplyfi-hack"},{"credibility":2,"name":"BlockSec In-depth Analysis and Reflections on the Resupply Protocol Attack Incident","type":"research","url":"https://blocksecteam.medium.com/blocksec-in-depth-analysis-and-reflections-on-the-resupply-protocol-attack-incident-932be23e1433"},{"credibility":3,"name":"ResupplyFi Rekt: How a $4K Flash Loan Led to a $9.8M ERC-4626 Donation Attack","type":"news_article","url":"https://nabilech.com/resupplyfi-rekt-how-a-4k-flash-loan-led-to-a-9-8m-erc-4626-donation-attack/"}]}],"sources_used":[{"credibility":2,"name":"ResupplyFi Rekt — Rekt News","type":"news_article","url":"https://rekt.news/resupplyfi-rekt"},{"credibility":2,"name":"ResupplyFi Hack Analysis — Ackee Blockchain","type":"research","url":"https://ackee.xyz/blog/resupply-hack-analysis/"},{"credibility":2,"name":"DeFi stablecoin lending protocol Resupply hit with $9.3m exploit — DL News","type":"news_article","url":"https://www.dlnews.com/articles/defi/defi-stablecoin-lending-protocol-resupply-hit-with-93m-exploit/"},{"credibility":2,"name":"ResupplyFi DeF exploit wstusr $9.6m loss — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/resupplyfi-defi-exploit-wstusr-96m-loss"},{"credibility":2,"name":"Resupply developer donates $1.4m after protocol suffers $9m exploit — DL News","type":"news_article","url":"https://www.dlnews.com/articles/defi/resupply-developer-donates-funds-after-9m-exploit/"},{"credibility":2,"name":"Stablecoin protocol Resupply proposes burning 6 million tokens after $10 million exploit — The Block","type":"news_article","url":"https://www.theblock.co/post/360226/resupply-six-million-burn"},{"credibility":2,"name":"Resupply protocol outlines recovery plan post $10M exploit, proposes $6M token burn — crypto.news","type":"news_article","url":"https://crypto.news/resupply-protocol-outlines-recovery-plan-post-10m-exploit-proposes-6m-token-burn/"},{"credibility":2,"name":"Hacker Drains $9.6 Million From DeFi Stablecoin Protocol Resupply — Decrypt","type":"news_article","url":"https://decrypt.co/327148/hacker-drained-9-6-million-from-defi-stablecoin-protocol-resupply"},{"credibility":2,"name":"The ResupplyFi Hack: The Audit Habit That Would Catch It — Veridise","type":"research","url":"https://veridise.com/blog/audit-insights/resupplyfi-hack-audit-habit/"},{"credibility":2,"name":"Lessons from the Resupply exploit — Guardrail","type":"research","url":"https://www.guardrail.ai/blog/resupplyfi-hack"},{"credibility":2,"name":"BlockSec In-depth Analysis and Reflections on the Resupply Protocol Attack Incident","type":"research","url":"https://blocksecteam.medium.com/blocksec-in-depth-analysis-and-reflections-on-the-resupply-protocol-attack-incident-932be23e1433"},{"credibility":2,"name":"Resupply Plans 6M reUSD Token Burn to Recover From $10M Hack — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2025/06/30/resupply-plans-6m-reusd-token-burn-to-recover-from-10m-hack/"},{"credibility":2,"name":"The Resupply attacker has deposited 1,607 ETH into Tornado Cash — PANews","type":"news_article","url":"https://www.panewslab.com/en/articles/caa3441e-5a92-415f-b8b7-81b54052db44"},{"credibility":2,"name":"Resupply — Projects & Protocols | IQ.wiki","type":"other","url":"https://iq.wiki/wiki/resupply"},{"credibility":2,"name":"Explained: The Resupply Hack (June 2025) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-resupply-hack-june-2025"},{"credibility":3,"name":"ResupplyFi Rekt: How a $4K Flash Loan Led to a $9.8M ERC-4626 Donation Attack","type":"news_article","url":"https://nabilech.com/resupplyfi-rekt-how-a-4k-flash-loan-led-to-a-9-8m-erc-4626-donation-attack/"},{"credibility":1,"name":"Resupply Official Website","type":"official","url":"https://resupply.finance/"}],"summary":"ResupplyFi is a decentralized stablecoin lending protocol developed as a subDAO by Convex Finance and Yearn Finance, launched in March 2025. On June 25–26, 2025, an attacker exploited an ERC-4626 first-donation vulnerability in a newly deployed vault, draining approximately $9.3–9.8 million in user funds using a $4,000 flash loan. The exploit created $10 million in reUSD bad debt; following a governance-approved recovery plan, the bad debt was ultimately fully repaid through a combination of insurance pool burns, personal contributions from a core developer, Convex treasury funds, and a Yearn loan.","timeline":[{"date":"2024-12-18","event":"ResupplyFi publicly introduced by Convex Finance and Yearn Finance.","source":"Convex Finance on X","source_url":"https://x.com/ConvexFinance/status/1869394912250314810"},{"date":"2025-03-20","event":"ResupplyFi officially launches on mainnet, supporting Curve Lend and Fraxlend collateral positions for borrowing reUSD.","source":"Convex Finance on X","source_url":"https://x.com/ConvexFinance/status/1902702988092735588"},{"date":"2025-02-01","event":"Security audits by ChainSecurity and yAudit (Electi) completed approximately three to four months before the exploit, covering the ResupplyPair codebase but not deployment initialization procedures.","source":"Rekt News — ResupplyFi Rekt","source_url":"https://rekt.news/resupplyfi-rekt"},{"date":"2025-06-25","event":"A new crvUSD-wstUSR lending pair vault is deployed on ResupplyFi. Within approximately two hours, an attacker executes an ERC-4626 first-donation attack, inflating vault share price to corrupt the exchange rate calculation and borrow $10 million in reUSD against 1 wei of collateral, stealing approximately $9.3 to $9.8 million. The exploit transaction hash is 0xffbbd492e0605a8bb6d490c3cd879e87ff60862b0684160d08fd5711e7a872d3.","source":"Ackee Blockchain Hack Analysis","source_url":"https://ackee.xyz/blog/resupply-hack-analysis/"},{"date":"2025-06-25","event":"ResupplyFi team identifies and pauses the affected wstUSR market. Protocol issues initial statement confirming only the wstUSR market is impacted.","source":"DL News","source_url":"https://www.dlnews.com/articles/defi/defi-stablecoin-lending-protocol-resupply-hit-with-93m-exploit/"},{"date":"2025-06-25","event":"Stolen ETH begins moving through Tornado Cash. Attacker deposits approximately 1,607 ETH (roughly $6.5 million) into the mixer.","source":"PANews","source_url":"https://www.panewslab.com/en/articles/caa3441e-5a92-415f-b8b7-81b54052db44"},{"date":"2025-06-26","event":"C2tP, a Convex Finance developer, publicly commits $1.4 million of personal funds toward covering user losses. Convex Finance contributes an additional $810,000 from its treasury.","source":"DL News","source_url":"https://www.dlnews.com/articles/defi/resupply-developer-donates-funds-after-9m-exploit/"},{"date":"2025-06-30","event":"ResupplyFi publishes a governance recovery proposal. The plan proposes burning $6 million reUSD from the insurance pool to cover remaining bad debt, with $1.13 million to be repaid gradually via protocol revenues and a Yearn loan. A shortened three-day voting period is requested.","source":"The Block","source_url":"https://www.theblock.co/post/360226/resupply-six-million-burn"},{"date":"2025-07-01","event":"Governance vote on recovery plan concludes. Insurance pool burn and resumption of withdrawal cooldown period proceed following approval.","source":"crypto.news","source_url":"https://crypto.news/resupply-protocol-outlines-recovery-plan-post-10m-exploit-proposes-6m-token-burn/"},{"date":"2025-08-01","event":"ResupplyFi announces full repayment of the $10 million bad debt created by the exploit. $8.8 million repaid via the insurance pool burn and developer/treasury contributions; remaining $1.13 million covered by Yearn loan to be repaid through RSUP staking revenues.","source":"AInvest","source_url":"https://www.ainvest.com/news/resupply-fully-repays-10-million-bad-debt-june-2025-exploit-2508/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision c9f15dda-3bd4-4aed-a30b-e58af5b5973ccopy