Warp Finance
Summary
Warp Finance was an Ethereum-based DeFi lending protocol that allowed users to borrow stablecoins against Uniswap liquidity provider (LP) tokens as collateral. On December 17–18, 2020, roughly one week after launch, an attacker exploited a manipulable AMM-based price oracle to artificially inflate LP token collateral values using flash loans, draining approximately $7.76 million in DAI and USDC. Approximately $5.85 million (roughly 75%) was subsequently recovered from the attacker's locked collateral with assistance from the white-hat community; the protocol relaunched in February 2021 with Chainlink price feeds replacing the vulnerable Uniswap oracle.
Connected Entities
1 entities · 10 linked investigationsTimeline(9 events)
2020-12-09
Warp Finance protocol launches on Ethereum mainnet, offering stablecoin loans collateralized by Uniswap LP tokens. No pre-launch security audit had been completed.
CoinDesk / Warp Finance Medium2020-12-17
At approximately 02:30 UTC, an unidentified attacker executes a multi-step flash loan attack. The attacker borrows ~2.9M DAI and ~344,800 WETH via flash loans from dYdX and Uniswap V2, deposits DAI to mint ~94,349 LP tokens as collateral, manipulates the Uniswap WETH-DAI pool reserve ratio to approximately double the reported LP token value, and borrows 3.86M DAI and 3.9M USDC (~$7.76M total) against the inflated collateral.
PeckShield Root Cause Analysis2020-12-18
Warp Finance team publicly acknowledges the exploit via Twitter, stating it is 'investigating irregular stablecoin loans.' CoinDesk and other outlets report the incident. Protocol deposits are suspended.
CoinDesk2020-12-18
PeckShield and SlowMist publish independent root cause analyses identifying the Uniswap AMM-based LP token oracle as the exploited vulnerability.
PeckShield Medium / SlowMist Medium2020-12-20
At 02:16 UTC, Warp Finance announces recovery of the exploiter's locked ETH/DAI-LP token collateral (~$5.688M, approximately 73–75% of lost funds) with assistance from white-hat researchers including Emiliano, Banteg, Samczsun, and Julien Bouteloup. Distribution to affected users is planned within 24 hours.
Warp Finance Medium / Decrypt2020-12-22
Recovered ETH/DAI-LP tokens (~$5.688M) distributed proportionally to affected depositors. The remaining ~$2M in stablecoins held by the attacker is not recovered.
Quadriga Initiative Case Study2021-01
Warp Finance announces the Portal IOU token compensation plan: 7,816,976 Portal IOU tokens issued to affected users, redeemable for WARP governance tokens at the planned token generation event, representing approximately 7.5% of total WARP supply.
Warp Finance Medium (Portal IOU clarification post)2021-01
Warp Finance announces integration of Chainlink price feeds (DAI/ETH, BTC/ETH, USDT/ETH, USDC/ETH) to replace the vulnerable Uniswap AMM oracle for the forthcoming relaunch.
Warp Finance Medium (Chainlink integration announcement)2021-02-09
Warp Finance relaunches as Warp V2 following a security audit by n-Var, with Chainlink oracle integration and revised LP token valuation logic. A bug bounty program is subsequently established via Immunefi.
Bitcoinist / BeInCryptoDecision Log
- hash: 2fv4427PaPQQFveffgpmarmvUvdhJYm5RZn8tPuBrGQy
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-5
generated: 5/30/2026, 1:00:24 PM
last updated: 5/30/2026, 1:00:28 PM
avoid.net — verified advice for a post-truth world