Thetanuts Exploit — Zero-Cost Index-Vault `mint()` via Rounding-Down Component Deposits

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2026-06-Thetanuts_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/Thetanuts_exp.sol.

Vulnerability classes: vuln/arithmetic/rounding · vuln/arithmetic/precision-loss

Reproduction: the PoC compiles & runs in an isolated Foundry project at this project folder. The fork is served offline from the bundled anvil_state.json (a local anvil at 127.0.0.1:8545), so no public RPC is needed. Full verbose trace: output.txt. The vulnerable contract is the Thetanuts index USDC PUT vault 0xC2C3AE0a7b405058558C9b4a63b373486CB86Ac7; its verified source is not bundled in sources/ for this PoC, so the code shown below is reconstructed from the on-chain trace and the storage-diff evidence in output.txt (every claim is line-referenced).

Key info#

TL;DR#

1. The Thetanuts index vault is an "index of vaults": one index share is backed by a pro-rata basket of component vault shares (BTC-USD, ETH-USD, AVAX-USD, BNB-USD, MATIC-USD). claim(amount) burns index shares and hands the caller the corresponding basket; mint(amount) does the inverse — it pulls the pro-rata basket from the caller via transferFrom and credits amount new index shares.

2. The fatal flaw is that mint(amount) computes each component's required deposit as amount * componentBalance / totalSupply with integer division and no round-up / no zero-check. When totalSupply is large relative to amount, that quotient truncates to 0, so mint() pulls 0 of every component yet still mints amount brand-new index shares.

3. The attacker flash-loaned the vault's entire circulating index supply from Aave — 153,054,600,569 shares (the aToken held 153,054,600,572, the attacker left a residual of 3) (output.txt:1625-1627) — and claim()ed it, burning the whole supply and pulling the entire component basket into the attack contract (output.txt:1640-1641).

4. After the claim, totalSupply collapsed to 3 (output.txt:1685-1686) and the index vault held zero component shares (they had all been transferred out). Now every component deposit required by mint() rounds to 0.

5. The attacker re-minted the index supply with a doubling loop — mint(2), mint(4), mint(8), … mint(15753396239) (output.txt:1687-2839) — each call pulling 0 of all five components (output.txt:1688-1707) while totalSupply roughly doubled (3 → 5 → 9 → 17 → 33 → … at storage slot 4, output.txt:1710,1742,1774). Eighteen-plus free mints later the attacker held 153,192,349,709 index shares (output.txt:2865-2866) — exactly the flash repayment (loan + premium).

6. The free-minted shares repaid Aave (output.txt:2902-2909). The attacker kept the entire component basket it had claimed in step 3, redeemed the BTC and ETH components for USDC via initWithdraw (70,315,563,951 + 35,155,935,127 = 105,471,499,078 USDC, output.txt:2924,2957,2984), and forwarded the USDC plus the leftover AVAX/BNB/MATIC shares to the profit receiver.

7. Net profit asserted and logged by the PoC: Profit receiver USDC profit: 105471.499078 (output.txt:1565,3025) — i.e. 105,471.50 USDC — plus 6,378,688,541 AVAX-, 17,186,382,409 BNB- and 10,028,704,387 MATIC-USD component shares (output.txt:2996,3004,3012).

Background — what Thetanuts does#

Thetanuts Finance runs option-vaults. The contract at 0xC2C3AE0a… is an index vault: a single ERC-20 "index" token whose value is backed by a basket of underlying component vault ERC-20 shares. The economic model is the classic "share basket":

• claim(amount) (the index vault's redeem path): burns amount index shares from the caller and sends the caller each component's pro-rata slice, amount * componentBalance / totalSupply (output.txt:1640-1671 shows the five component transfers out of the index vault).
• mint(amount) (the index vault's deposit path): for each component, transferFroms the caller's pro-rata deposit amount * componentBalance / totalSupply into the vault, then mints amount new index shares (output.txt:1687-1712 shows five transferFroms followed by a mint Transfer(from: 0x0…, to: attacker, value: 2)).
• Each component vault (BTCUSD, ETHUSD, etc.) is itself a vault whose initWithdraw(shares) burns the component shares and returns USDC to the caller (output.txt:2918-2948).

On-chain parameters at the fork block (read from the trace):

The whole game is the relationship componentDeposit = amount * componentBalance / totalSupply: once the attacker drives the index vault's component holdings to 0 (via claim) and totalSupply to a tiny value, every subsequent mint() pulls 0 of everything yet mints real shares.

The vulnerable code#

Note on source provenance: the verified Solidity for the index vault is not included in this PoC's sources/ directory. The snippets below are reconstructed from the on-chain execution trace and the EVM storage diffs in output.txt. They are the minimal logic the trace proves the vault ran; they are not copied from a verified source file, and no source line numbers are cited for them. The PoC's interface declarations are real and line-referenced.

1. The PoC's view of the vault interface (real, from the PoC)#

interface IThetanutsIndexVault is IERC20 {
    function claim(uint256 amount) external;
    function mint(uint256 amount) external;
}

interface IThetanutsComponentVault is IERC20 {
    function initWithdraw(uint256 shares) external returns (uint256 assets);
}

(test/Thetanuts_exp.sol:35-48)

2. mint(amount) — pro-rata deposit truncates to zero (reconstructed from the trace)#

The trace shows that mint(2) triggered five component transferFroms, all with value: 0, immediately before minting 2 index shares:

// RECONSTRUCTED from output.txt — not verified source
function mint(uint256 amount) external {
    uint256 supply = totalSupply();                  // == 3 right after the claim
    for (uint256 i = 0; i < components.length; i++) {
        IERC20 c = components[i];
        // pro-rata deposit, integer division, rounds DOWN, no round-up, no zero guard:
        uint256 deposit = amount * c.balanceOf(address(this)) / supply; // = 2 * 0 / 3 = 0
        c.transferFrom(msg.sender, address(this), deposit);             // pulls 0
    }
    _mint(msg.sender, amount);                        // ⚠️ mints `amount` shares for free
}

Trace evidence for mint(2):

• five transferFrom(…, value: 0) (output.txt:1688-1707),
• emit Transfer(from: 0x0…, to: attacker, value: 2) (output.txt:1708),
• totalSupply slot 4: 3 → 5 (output.txt:1710).

3. claim(amount) — burns shares, ships the whole component basket out (reconstructed)#

// RECONSTRUCTED from output.txt — not verified source
function claim(uint256 amount) external {
    _burn(msg.sender, amount);                        // burns the flash-loaned supply
    uint256 supply = totalSupplyBeforeBurn;           // ~1.53e11
    for (uint256 i = 0; i < components.length; i++) {
        IERC20 c = components[i];
        uint256 out = amount * c.balanceOf(address(this)) / supply;
        c.transfer(msg.sender, out);                  // ships the basket to the caller
    }
}

Trace evidence: claim(153054600569) emits Transfer(attacker → 0x0, 153054600569) (output.txt:1641) and the five component transfers out of the vault (output.txt:1642-1671); afterward totalSupply == 3 (output.txt:1685-1686).

Root cause — why it was possible#

The bug is a rounding-direction error combined with no zero-deposit guard in the index vault's mint() accounting. Three facts compose into free shares:

1. Pro-rata deposit rounds down. deposit = amount * componentBalance / totalSupply uses Solidity integer division, which rounds toward zero. A deposit path must round in the protocol's favour (round up, and reject a 0 deposit for a non-zero mint). Here it rounds down and accepts 0.

2. The attacker can drive componentBalance to 0 and totalSupply tiny in the same transaction. claim() is the lever: flash-loaning and claiming the entire circulating supply burns totalSupply down to a dust value (3) and empties the index vault of every component share. With componentBalance == 0, the numerator amount * 0 is identically zero — every mint() is free, regardless of amount.

3. No invariant ties shares minted to assets received. mint() never checks that it actually pulled value commensurate with the shares it credits. A single reconciliation — "require each component deposit ≥ its rounded-up pro-rata amount, and revert on a zero deposit for a non-zero mint" — would have made every free mint revert.

The flash loan is just capital efficiency: it lets the attacker temporarily own the whole supply so that claim() can zero out the vault's component holdings, after which the re-mint costs nothing. The attacker walks away with the entire claimed basket (redeemed to 105,471.50 USDC + residual component shares) while repaying the flash with shares it minted out of thin air.

Preconditions#

• A borrowable stock of index shares. Aave held 153,054,600,572 index shares as a reserve aToken (output.txt:1625-1626); the attacker flash-loaned all but 3 of them (output.txt:1627). This let the attacker transiently own ~100% of the supply.
• claim() reachable and un-throttled, so the attacker can burn the borrowed supply and pull the full component basket (output.txt:1640-1641).
• mint() reachable with the rounding bug — i.e. totalSupply large relative to amount, or componentBalance == 0. Both hold after the claim (totalSupply = 3, component holdings = 0).
• At least one component redeemable to USDC so the loot becomes liquid. The attacker initWithdraws the BTC and ETH components (output.txt:2918,2951); AVAX/BNB/MATIC shares are forwarded as-is (output.txt:2994-3017).
• Working capital is flash-loanable — the entire position opens and closes inside one Aave flashLoan callback (output.txt:1627-2914).

Attack walkthrough (with on-chain numbers from the trace)#

All figures are taken directly from the Transfer / Mint events, totalSupply returns and storage diffs in output.txt. Index shares and component shares are 6-decimal raw integers; human approximations in parentheses.

Note: slot-4 totalSupply ends at 0x…23aaf9c010 = 153,192,349,712 (= attacker's 153,192,349,709 + the 3 residual shares), consistent with the attacker's balance of 153,192,349,709 at output.txt:2865-2866.

Profit / loss accounting (USDC, raw 6-decimal wei)#

70,315,563,951 + 35,155,935,127 = 105,471,499,078 USDC, matching the attacker's USDC balance (output.txt:2982-2984) and the asserted profit assertGt(105471499078, 105000000000) (output.txt:3026). The flash loan + premium (153,192,349,709 index shares) was repaid entirely from free-minted shares, so the only capital the attacker spent was gas — the loot is pure profit.

Diagrams#

Sequence of the attack#

Index-vault state evolution#

The flaw inside mint()#

Why the mint is theft: shares-vs-assets before vs. after#

Why each magic number#

• residualIndexShares = 3 / loan = aToken.balanceOf - 3 (153,054,600,569) (test/Thetanuts_exp.sol:107-108): the attacker borrows all but 3 of Aave's index shares. Leaving a tiny residual (3) keeps totalSupply non-zero after the claim burn — the trace confirms post-claim totalSupply == 3 (output.txt:1685-1686) — so the mint() division amount * 0 / 3 is well-defined (no divide-by-zero) and still rounds to 0.
• repaymentShares = borrowedShares + premiums[0] (153,054,600,569 + 137,749,140 = 153,192,349,709) (test/Thetanuts_exp.sol:135-137): the exact number of free shares the attacker must re-mint to satisfy Aave; matches the final balance 153,192,349,709 (output.txt:2865-2866) and the approve amount (output.txt:2867).
• nextSupplyBoundary = 1 / supplyBoundedMint = totalSupply() - 1 (test/Thetanuts_exp.sol:145-147): caps each mint at totalSupply - 1. Because each free mint of ~totalSupply shares doubles totalSupply, the loop needs only ~log₂(1.53e11) ≈ 38 iterations — exactly the doubling sequence 2,4,8,…,34359738368, 15753396239 visible in the trace (output.txt:1687-2839). The final mint(15753396239) is the remainder to hit the repayment target precisely.
• The five component vault addresses (BTC/ETH/AVAX/BNB/MATIC-USD) (test/Thetanuts_exp.sol:29-33): the basket backing one index share. Only BTC and ETH are redeemed to USDC (initWithdraw, test/Thetanuts_exp.sol:116-117); the rest are forwarded as raw component shares.
• assertGt(usdcProfit, 105_000_000_000) (test/Thetanuts_exp.sol:83): the success threshold (105,000 USDC). The realized profit 105,471,499,078 clears it (output.txt:3026).

Remediation#

1. Round component deposits UP and reject zero. In mint(), compute each required deposit with ceiling division ((amount * componentBalance + totalSupply - 1) / totalSupply) and `require(deposit

   0)wheneveramount > 0andcomponentBalance > 0`. A mint that pulls nothing for non-zero shares must revert.

2. Reconcile shares against assets received. After pulling the basket, assert that the vault's component balances increased by at least the rounded-up pro-rata amounts before crediting shares. Never _mint more value than was actually deposited.
3. Handle the empty-vault / dust-supply edge cases explicitly. When componentBalance == 0 or totalSupply is below a safe floor, mint() must use a fixed 1:1 (or seeded) exchange rate, or revert — the "first depositor / empty pool" pattern, not silent free shares.
4. Make claim() and mint() non-composable within one transaction / one block for the same actor, or add a re-entrancy/flash-loan guard, so an attacker cannot burn the whole supply and re-mint it in the same call frame.
5. Cap single-operation supply impact. A single mint/claim that moves totalSupply by more than a small fraction (here it went 3 → 1.53e11) should revert; doubling the supply for zero assets is a glaring invariant break.

How to reproduce#

The PoC runs fully offline against the bundled anvil_state.json (a local anvil at 127.0.0.1:8545); setUp() does vm.createSelectFork("http://127.0.0.1:8545", 25_323_328) (test/Thetanuts_exp.sol:52-53), so no public archive RPC is required.

_shared/run_poc.sh 2026-06-Thetanuts_exp --mt testExploit -vvvvv

• foundry.toml sets evm_version = 'cancun' and grants read access to the project directory for the anvil state file; the harness compiles with Solidity 0.8.34.
• Result: [PASS] testExploit() with Profit receiver USDC profit: 105471.499078.

Expected tail (from output.txt:1561-1566 and output.txt:3055-3057):

Ran 1 test for test/Thetanuts_exp.sol:ContractTest
[PASS] testExploit() (gas: 3651602)
Logs:
  Profit receiver USDC profit: 105471.499078

...

Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 6.77s (5.56s CPU time)

Ran 1 test suite in 6.78s (6.77s CPU time): 1 tests passed, 0 failed, 0 skipped (1 total tests)

Reference: PeckShieldAlert — https://x.com/PeckShieldAlert/status/2066540451126190312 (Thetanuts, Ethereum, ~$105.5K).

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2026-06-Thetanuts_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: Thetanuts_exp.sol.
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• DeFiHackLabs incident explorer: search "Thetanuts Exploit".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.