Digital Asset
Intelligence
Security Incident · Avalanche Ecosystem

TranchePool Smart Contract Vulnerability: $1.01M Reported Loss

·Source-attributed incident record

Incident Overview

A TranchePool on Avalanche associated with Valinor Digital, Oatfi, and Fence Finance was exploited due to a settlement logic flaw. At the UTC day rollover, a scheduled principal payment was incorrectly treated as received, artificially restoring ~$1.013M of draw capacity and allowing the attacker to draw the same amount of USDC a second time.

Sources & References

Original incident referencehttps://x.com/SlowMist_Team/status/2115281126516490514?a=nMv1W8-mPKDp1ZlylyA&s=20 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Attack methodMisconfiguration
    Reported loss$ 7,450,000
  2. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 64,000
  3. Incident date
    Target

    Seedify

    Attack methodPrivate Key Leakage
    Reported loss$ 1,700,000
  4. Incident date
    Attack methodGovernance Attack
    Reported loss$ 1,000,000
  5. Incident date
    Target

    Diamante

    Attack methodUnknown
    Reported lossNot disclosed