Digital Asset
Intelligence
Security Incident

Flamincome Smart Contract Vulnerability: $345.90K Reported Loss

·Historical incident record

Incident Overview

Flamincome (legacy contracts of Flamingo Finance) was exploited due to unsafe asset accounting and valuation. The attacker flash-loaned ~$18M USDT, injected USDP/3CRV LP into the Strategy (treating a permissionlessly injectable Convex BaseRewardPool balance as its own assets and overvaluing it via Curve’s get_virtual_price() in a depegged pool), inflated the VaultYUSDT share price, and redeemed real Aave aUSDT liquidity for ~$345.9K profit.

Sources & References

Original incident referencehttps://x.com/SlowMist_Team/status/2100256590716907706 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Attack methodFlash Loan Price Manipulation
    Reported loss$ 345,900
  2. Incident date
    Target

    Nimiq

    Attack methodSmart Contract Vulnerability
    Reported loss$ 50,463
  3. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 10,000
  4. Incident date
    Target

    $TENDRIL

    Attack methodSmart Contract Vulnerability
    Reported loss$ 555000
  5. Incident date
    Attack methodUnknown
    Reported lossNot disclosed