TLDR:
- RedSonic Vault lost 9.25 ETH after an attacker exploited a dual-asset pricing flaw entirely.
- A permissionless registerErc20 function let the attacker add a second, conflicting stETH share class.
- The attacker flash-loaned 1,139 WETH from Balancer and needed zero starting capital of their own.
- ExVulSec traced the full exploit, including the Curve swap and the final loan repayment step.
A flash loan attacker drained 9.25 ETH from Ethereum’s RedSonic Vault in a single transaction. Blockchain security firm ExVulSec identified the exploit and published a full technical breakdown.
The attacker manipulated a permissionless asset-registration function to double count the same underlying collateral. On-chain records show the entire operation executed inside one self-contained transaction.
How the RedSonic Vault Exploit Unfolded
The attacker flash-loaned 1,139 WETH from Balancer to fund the entire operation. No upfront capital of their own was required.
RedSonic’s vault prices its rsvETH shares through a function called getTotalAssetBalance. For the Lido position, that function reads the vault’s raw stETH balance directly.
That design choice became the exploit’s foundation. Share prices tied directly to a raw balance can shift if that balance changes unexpectedly. No corresponding shares need to be minted or burned.
The vault’s registerErc20 function carried no access restrictions, according to ExVulSec. Anyone could register a brand new asset class inside the vault.
The attacker registered stETH as a second asset, creating a class called rsvstETH. Both share types then drew from the exact same underlying stETH balance.
The exploit contract self-destructed once execution finished. Security researchers note that self-destructing contracts often complicate later on-chain tracing efforts.
Flash loans let borrowers access large sums without posting collateral, provided the loan gets repaid within the same transaction. Attackers commonly use this mechanism to fund exploits that would otherwise demand substantial capital.
RedSonic Vault Exploit Exposes a Dual-Asset Flaw
The attacker deposited 1,130 ETH first, acquiring close to 99% of all outstanding rsvETH shares. That position set up the rest of the exploit.
Next, the attacker deposited 9.34 stETH directly into the vault. That single deposit inflated the stETH balance without minting any new rsvETH shares.
Because rsvETH pricing reads the raw stETH balance, the extra deposit pushed the share price higher artificially. The attacker’s existing rsvETH holdings gained value instantly as a result, without any new rsvETH being issued.
The attacker then redeemed rsvETH for 1,139.5 ETH, according to ExVulSec’s transaction analysis. That single redemption produced the full 9.25 ETH profit.
The same attacker also redeemed the rsvstETH shares for stETH separately. The identical underlying collateral effectively paid out twice from one shared, pooled vault balance.
ExVulSec reported that the recovered stETH was swapped for ETH on Curve. The attacker repaid the Balancer flash loan within that same transaction.
Etherscan data lists the attacker’s wallet as 0x70f2333d21Ed7E7D105F6578227A9A747687982C. The RedSonic Vault contract itself sits at 0x4315990d9eeaffdfafd49958b4851f203fa1126f.
The attack transaction carries the hash 0xe3cba90e865c6cba950ebce36a52607f51f1fd33cd9fb920c78803f19b57791a. It remains publicly viewable on Etherscan for anyone verifying the exploit’s details.
