link.png

ID:

nereus-finance-1098

Date:

Status:

Incident Count:

September 6, 2022

Verified

1

info.png
target.png
REKT

Contributor:

chain.png

web3rekt.com

KYC By:

KYC:

None

info.png

Audit By:

Audits:

Ambisafe

Loss Amount:

371,296

info.png

Recovered:

-

Rewards:

Currency:

USD, NXUSD

info.png

Key Indicators

Platform:

Type:

Category:

Method:

Data Sources:

Avalanche

Protocol

Dexes

Flash Loans

Extended Method:

Price manipulation

info.png

Days in Operation:

160

(0.44 Years)

chain.png
chain.png
chain.png
chain.png
datasource.png

Nereus is a decentralized, non-custodial liquidity market protocol in which users can participate as depositors or borrowers. Depositors provide liquidity to the market to earn a passive income, while borrowers can borrow in an over-collateralized (perpetually) or undercollateralized (one-block liquidity) fashion. Nereus is optimized to provide dynamic and fixed interest rates with lower collateral requirements, with a focus on use cases beyond trading and price speculation.

According to the team's post-mortem, an exploiter was able to deploy a custom smart contract and that leveraged a $51M flash loan to manipulate the AVAX/USDC Trader Joe LP pool price for a single block resulting in the ability for the exploiter to mint 998,000 NXUSD against ~$508k worth of collateral.

Post-mortem indicated that there was a missed step in the price calculation resulting in the opportunity to be exploited. The price calculation was based on the current wAvaxReserve price, usdcReserve price, and totalSupply taken on-chain from the TraderJoe Pool directly without any time weighted average price mechanism implemented in order to prevent potential single block manipulation. Accordingly, wavaxReserve, usdcReserve, and totalSupply were susceptible to price manipulation due to lack of TWAP calculation.

info.png

DISCLAIMER: While web3rekt has used the best efforts in aggregating and maintaining this database, this web site makes no representations or warranties with respect to the accuracy or completeness of its information and data herein, and specifically disclaim any implied warranties of merchantability or fitness for any particular purpose. 

Under no circumstances, shall web3rekt be liable for any loss of profit or funds, any regulatory or governmental penalties, any legal costs, or any other commercial and non-commercial damages, including but not limited to special, incidental, consequential, or other damages from any or all usage of the data and information derived from this database.