Harvest Finance · flash loan exploit

A flash loan swings Curve's Y pool balances, temporarily mispricing Harvest's vault shares. The attacker deposits low and redeems high in the same transaction, draining depositors — with a TWAP oracle as the illustrated fix.
Attacker flash loan Uniswap loan pool ~$50M USDC Curve Y pool balance skew: 0% Harvest fUSDC vault share price: $1.000 Mint / redeem TWAP window: off Depositor losses $0 lost
Vault share price
$1.000
Attacker profit (cumulative)
$0
Vault TVL remaining
$0
Attack cycles executed
0
Parameters — edit me
$50M
$80M
0 blocks
0.6/s
Controls

Illustrative simulation. Mirrors the researched mechanism (~$50M flash loan distorting Curve's Y pool, share-price mispricing, deposit-low/redeem-high cycles draining ~$24-34M) — cycle sizes and timing are randomized for visualization, not live onchain data. Raise the TWAP-window slider to see how a manipulation-resistant oracle would have blunted the attack. Part of The Onchain Experiment Atlas.