Minterest (Mantle) Exploit — Stale Exchange-Rate in `lendRUSDY` Inflates mUSDY Collateral

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2024-07-Minterest_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/Minterest_exp.sol.

Vulnerability classes: vuln/oracle/stale-price · vuln/logic/incorrect-order-of-operations

Reproduction: the PoC compiles & runs in an isolated Foundry project at this project folder (the umbrella DeFiHackLabs repo does not whole-compile, so this PoC was extracted and run on its own). Full verbose trace: output.txt. Verified vulnerable sources: MUSDYToken.sol, MToken.sol, rUSDYW.sol.

Key info#

TL;DR#

Minterest deployed a special market, mUSDY, that lets users supply collateral denominated in Ondo's rebasing rUSDY token while the market accounts internally in the underlying USDY. The supply entry point, lendRUSDY(), snapshots the market exchange rate before it pulls the deposit in, but the matching exit, redeemUnderlying(), recomputes the exchange rate after the deposit's cash is already sitting in the market.

Because the deposit (≈ 4.27M USDY per loop, sourced from a flash loan) is huge relative to the market's existing cash, it materially moves the market's exchange rate. So within one lend → redeem round-trip:

• lendRUSDY mints mUSDY at the lower pre-deposit rate ⇒ more collateral tokens minted.
• redeemUnderlying burns mUSDY at the higher post-deposit rate ⇒ fewer collateral tokens burned to pull the same USDY back out.

Net effect: every loop the attacker pulls ~all of their USDY back and keeps a sliver of mUSDY collateral for free. Repeated 24 times, this inflated the attacker's mUSDY balance to 87.44e18 (raw), which the Minterest Supervisor valued as enormous collateral. The attacker then simply borrowed 223 WETH + 204 mETH (≈ 427 ETH) against that phantom collateral and walked away.

The rUSDY wrap/unwrap detour (USDY → rUSDY → market → USDY) is the wrapper that makes lendRUSDY/redeemUnderlying usable with a flash loan denominated in USDY; the exploitable defect is the stale-rate asymmetry inside the Minterest market, not in Ondo's token.

Background — what the protocol does#

Minterest is a Compound-v2-style money market (markets are MTokens; each tracks totalTokenSupply, accountTokens[user], totalBorrows, and an exchangeRate derived from them). On Mantle, Minterest added an rUSDY-aware market (MUSDYToken) so users could supply Ondo collateral:

• MToken (MToken.sol) — the generic Compound-fork market. exchangeRate = (cash + totalBorrows − protocolInterest) / totalTokenSupply (MToken.sol:252-266), where cash = underlying.balanceOf(this) (MToken.sol:278-280).
• MUSDYTokenV1 / MUSDYToken — adds rUSDY entry points. unwrapTokens converts the deposited rUSDY back to USDY inside the market and measures the actual USDY balance delta (MUSDYTokenV1.sol:97-109).
• rUSDYW (rUSDYW.sol) — Ondo's rebasing rUSDY wrapper. wrap(USDY) mints rUSDY; unwrap(rUSDY) returns USDY. The conversion is oracle-priced via RWADynamicOracle.getPrice() (≈ 1.0488952e18 at the fork block), so 1 USDY ≈ 1.0489 rUSDY (rUSDYW.sol:383-394).

The mWETH / mMETH markets hold the real liquidity the attacker ultimately stole.

The vulnerable code#

1. lendRUSDY snapshots the rate before adding the deposit's cash#

The deployed override on MUSDYToken:

// MUSDYToken.sol:26-47
function lendRUSDY(uint256 _rUsdyLendAmount) external override {
    accrueInterest();
    supervisor.beforeLend(this, msg.sender);
    require(accrualBlockNumber == getBlockNumber(), ErrorCodes.MARKET_NOT_FRESH);

    // Order of actions here is crucial
    // 1. Calculate exchange rate based on parammeters before user's action
    uint256 exchangeRateMantissa = exchangeRateStoredInternal();          // ⚠️ rate snapshot BEFORE cash arrives
    // 2. Transfer USDY tokens from sender to the market contract (changes market's total cash)
    uint256 usdyLendAmount = unwrapTokens(_rUsdyLendAmount, msg.sender);  // ← market USDY cash jumps by ~4.27M
    // 3. Calculate amount of MTokens to mint
    uint256 lendTokens = (usdyLendAmount * EXP_SCALE) / exchangeRateMantissa;  // ← divided by the LOW pre-deposit rate

    totalTokenSupply += lendTokens;
    accountTokens[msg.sender] += lendTokens;
    ...
}

MUSDYToken.sol:26-47

2. redeemUnderlying recomputes the rate after the deposit's cash is present#

// MToken.sol:391-394
function redeemUnderlying(uint256 redeemAmount) external {
    accrueInterest();
    redeemFresh(msg.sender, 0, redeemAmount, true, false);
}

// MToken.sol:406-431 (redeemFresh)
uint256 exchangeRateMantissa = exchangeRateStoredInternal();             // ⚠️ rate snapshot AFTER cash already added
...
redeemTokens = (redeemAmount * EXP_SCALE) / exchangeRateMantissa;        // ← divided by the HIGH post-deposit rate

MToken.sol:406-432

Both functions use the same formula tokens = amount * 1e18 / exchangeRate, but they evaluate exchangeRate at two different points in the cash lifecycle. Because exchangeRate = (cash + …) / totalTokenSupply, a large deposit raises the rate. So:

• mint uses rate_before (lower) → mints more tokens,
• burn uses rate_after (higher) → burns fewer tokens,

for the same underlying value. The difference is pure, free collateral.

3. The rUSDY conversion that makes it flash-loanable#

// rUSDYW.sol:429-436
function wrap(uint256 _USDYAmount) external whenNotPaused {
    uint256 usdySharesAmount = _USDYAmount * BPS_DENOMINATOR;       // BPS_DENOMINATOR = 10_000
    _mintShares(msg.sender, usdySharesAmount);
    usdy.transferFrom(msg.sender, address(this), _USDYAmount);
    emit Transfer(address(0), msg.sender, getRUSDYByShares(usdySharesAmount));  // = _USDYAmount * price / 1e18
    ...
}
// getRUSDYByShares: shares * price / (1e18 * 10_000)
// getSharesByRUSDY: rUSDY * 1e18 * 10_000 / price

rUSDYW.sol:383-453

The wrap/unwrap round-trip is itself ~value-neutral (U → U·price/1e18 rUSDY → back to U). Its only role in the exploit is to convert the flash-loaned USDY into the rUSDY that lendRUSDY consumes and to convert the redeemed USDY back so the flash loan can be repaid.

Root cause — why it was possible#

A Compound-fork market’s exchange rate is a function of its own cash: exchangeRate = (cash + totalBorrows − protocolInterest) / totalTokenSupply. The market is only safe if mint and redeem evaluate that rate at the same logical instant — either both before the caller’s cash movement or both after. Minterest’s rUSDY override broke that symmetry:

lendRUSDY deliberately snapshots exchangeRateStoredInternal() before unwrapTokens adds the deposit to cash (the inline comment even says "Order of actions here is crucial … 1. Calculate exchange rate based on parameters before user's action"). But the generic redeemFresh it pairs with snapshots the rate after that cash is already counted. The attacker’s deposit is large enough to move the rate between those two points, so a single lend → redeem cycle is net-positive in collateral tokens.

The four ingredients that compose into a critical bug:

1. Asymmetric rate timing. Mint at pre-deposit rate, redeem at post-deposit rate (the core defect).
2. Self-funded rate manipulation. cash = underlying.balanceOf(this) is moved by the caller’s own deposit — no other party is needed to shift the rate. A flash loan supplies the size.
3. redeemUnderlying lets you pull cash back out without un-minting all collateral. Because it redeems by underlying amount, it burns only the (smaller) post-rate token count, leaving the residual collateral behind.
4. Inflated collateral is borrowable. The Minterest Supervisor values accountTokens × exchangeRate as collateral with no sanity check that real backing exists, so the phantom mUSDY directly unlocks borrows in other markets (mWETH, mMETH).

Preconditions#

• A large USDY flash loan (the pool 0xe38E…3340 lent ≈ 4.27M USDY per the trace) to make each deposit dwarf the market’s standing cash, maximizing the per-loop rate shift.
• The mUSDY market must be enabled as collateral for the attacker (Proxy.enableAsCollateral([mUSDY]), Minterest_exp.sol:77).
• The attacker (or any address) must be whitelisted — Supervisor.beforeLend checks isWhitelisted(msg.sender), which returned true for the attacker (output.txt:171-174).
• Sufficient liquidity in the target borrow markets (mWETH held ≈ 223.6 WETH, mMETH held ≥ 204 mETH).

Attack walkthrough (with on-chain numbers from the trace)#

The attacker contract is driven via a fallback that decodes selector 0x847d282d and runs a 24-iteration loop (Minterest_exp.sol:96-106). The bootstrap USDY is delivered as an ERC-3156-style flash() of 4,265,391 USDY from pool 0xe38E…3340 (output.txt:54).

Per-loop mechanics (iteration 1, exact trace values)#

The two exchange rates differ precisely because step (b) injected the deposit before (c) read the rate:

exchangeRate at lend   (pre-deposit)  = 1,552,234 USDY / mUSDY
exchangeRate at redeem (post-deposit) = 1,661,815 USDY / mUSDY   → fewer tokens burned

Collateral accrual across 24 loops#

Each loop the net mUSDY kept grows (the rate climbs as cash and minted supply accumulate), from 0.18e18 (iter 1) to 15.47e18 (iter 24):

At the borrow, the Supervisor saw the attacker holding 87.4405e18 mUSDY valued at exchange rate 18,947 USDY/mUSDY ⇒ a phantom collateral value of ≈ 1,656,762 USDY, despite the attacker’s real net USDY contribution being negligible (each loop returned ~all the USDY).

Cashing out#

With the inflated mUSDY collateral booked, the attacker borrowed directly from the real markets (Minterest_exp.sol:82-83):

Final balances logged by the PoC (output.txt:6-8):

[End] Attacker WETH balance after exploit: 223.000000000000000000
[End] Attacker mETH balance after exploit: 204.000000000000000000
[End] Attacker musdy balance after exploit: 874404819949.54532689   (87.4405e18 raw)

Profit / loss accounting#

The borrowed assets are pure profit: the “collateral” backing them was conjured by the rate asymmetry, so the attacker never repays and the protocol eats the 427 ETH of real liquidity.

Diagrams#

Sequence of the attack#

mUSDY collateral evolution#

Why one loop is net-positive: the rate-timing asymmetry#

Remediation#

1. Snapshot the exchange rate at the same point for lend and redeem. The Minterest lendRUSDY override deliberately reads exchangeRateStoredInternal() before unwrapTokens adds the cash, while redeemFresh reads it after. Use the standard lendFresh flow (which transfers in cash first, then reads the rate — MToken.sol:334-363) so both sides evaluate the rate with the deposit consistently counted (or not). Mixing the two is the bug.
2. Never let cash = balanceOf(this) be moved by the same call that prices against it. Either measure the deposit delta and compute mint tokens against the pre-deposit state for both mint and redeem, or use a cash variable that is updated atomically and read identically everywhere. A round-trip lend(x); redeem(x) must be a strict no-op (or net-negative after fees).
3. Add a round-trip invariant / dust guard. Assert that lend immediately followed by redeem of the same underlying amount cannot increase accountTokens[user]. Reject deposits/redeems whose token count differs from the inverse operation by more than rounding dust.
4. Sanity-check collateral against real backing. The Supervisor should not value collateral that exceeds the underlying actually held for that market segment; cross-check totalTokenSupply × exchangeRate ≈ cash + totalBorrows and revert on large divergences.
5. Cap per-transaction collateral growth. A single transaction that grows a user's collateral by orders of magnitude (here 0 → 87.44e18 mUSDY) without commensurate net cash inflow should be impossible; rate-limit or revert on anomalous intra-block collateral mints.

How to reproduce#

The PoC was extracted into a standalone Foundry project (the umbrella DeFiHackLabs repo does not whole-compile under forge test):

_shared/run_poc.sh 2024-07-Minterest_exp -vvvvv

• RPC: a Mantle archive endpoint is required for fork block 66,416,576. The bundled blastapi mantle endpoint has been retired (returns HTTP 403 "Blast API is no longer available"), and the public mantle.drpc.org load-balancer intermittently 500s on archive storage reads. This project’s foundry.toml therefore uses the official https://rpc.mantle.xyz, which serves historical state at that block reliably.
• Result: [PASS] testExpolit().

Expected tail:

Ran 1 test for test/Minterest_exp.sol:Exploit
[PASS] testExpolit() (gas: 6661707)
Logs:
  [End] Attacker musdy balance after exploit: 874404819949.54532689
  [End] Attacker WETH balance after exploit: 223.000000000000000000
  [End] Attacker mETH balance after exploit: 204.000000000000000000
Suite result: ok. 1 passed; 0 failed; 0 skipped

Reference: DeFiHackLabs — Minterest (Mantle), July 2024, ~427 ETH.

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2024-07-Minterest_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: Minterest_exp.sol.
• Attack transaction: view on explorer.

Alerts & third-party analyses

• DeFiHackLabs incident explorer: search "Minterest (Mantle) Exploit".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.