Venus Protocol: THE market event originated from a supply cap vulnerability, not a flash loan attack

Venus Protocol released a statement regarding the THE market event, stating that this incident was not a flash loan attack, but rather a result of the attacker exploiting a supply cap vulnerability in the old code of the protocol. The team indicated that the attacker had been accumulating THE tokens for about 9 months, gradually establishing a dominant supply position on Venus.

The announcement pointed out that the attacker bypassed the normal deposit process by directly transferring THE tokens into the protocol contract, thereby breaking through the supply cap limit of 14.5 million THE. They manipulated DEX prices by taking advantage of the low on-chain liquidity. As the external price was gradually reflected by the TWAP oracle, the attacker borrowed assets (such as CAKE, BNB, etc.) against the inflated collateral value, then bought more THE to drive up the price, and continuously transferred THE into the vTHE market to increase the collateral value. This cycle once pushed the price from about $0.27 to about $0.53, ultimately leaving bad debt in the protocol after the positions were liquidated.

Venus stated that it has currently suspended the THE market, reduced its collateral factor to 0, and suspended withdrawals. Additionally, as a precautionary measure, the collateral factors for 8 markets including BCH, LTC, AAVE, POL, FIL, TWT, UNI, and lisUSD have also been reduced to 0. The team and security partners are continuing to investigate and will release a complete post-analysis report in the future.