Enso Finance strategy vault — short Uni V3 TWAP overvalues FARM deposits

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2026-09-EnsoFinance_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/EnsoFinance_exp.sol.

Vulnerability classes: vuln/oracle/manipulable-twap · vuln/oracle/spot-price · vuln/oracle/missing-circuit-breaker · vuln/logic/price-calculation

Reproduction: the PoC compiles & runs in an isolated Foundry project at this project folder. Full verbose trace: output.txt. Source test: test/EnsoFinance_exp.sol.

Key info#

TL;DR#

The Enso strategy vault mints deposit shares as:

mint = amountAddedValue * totalSupply / valueBefore

Valuation runs EnsoOracle → per-item estimators → Uniswap V3 TWAP (pool.observe). The FARM item is priced off an imbalanced, thinly-observed V3 pool with a short, per-pool TWAP window (trace: observe(uint32[]) selector 0x883bdbfd), so it prints ~9× the V2 market.

Attacker (1 ETH capital):

1. Buys 268.42 FARM for 0.6828 WETH on the correctly-priced Uni V2 WETH/FARM pair.
2. controller.deposit(strategy, router, 0, 0, abi.encode(Call[{settleTransferFrom(FARM, this, strategy)}])) — permissionless. Oracle credits the FARM at several ETH.
3. controller.withdrawWETH burns the inflated shares; GenericRouter transferFroms the strategy's real UNI / AAVE / MKR to the attacker (amounts from the live tx).
4. Sells those tokens back to WETH, unwraps. Net 5.277 ETH in the PoC.

Controller/oracle impls are unverified; signatures are 4-byte-matched from the trace (deposit=0x71b8dc69, withdrawWETH=0x716e2615, settleTransferFrom=0xc5067ad4).

Background#

Enso StrategyController-managed baskets hold DeFi blue-chips. Deposits go through a GenericRouter Call[] so the controller can pull arbitrary tokens in, then mint shares on the oracle delta, not on a conservative min(spot, TWAP) per asset.

A short TWAP on a thin pool is a spot oracle with extra steps.

The vulnerable code#

RECONSTRUCTED from 4-byte-matched calls + trace (controller/oracle unverified):

function deposit(address strategy, address router, uint256 amount, uint256 slippage, bytes calldata data) external payable;
// data = abi.encode(Call[{target: router, callData: settleTransferFrom(FARM, attacker, strategy)}])
// shares minted from oracle value delta of tokens that landed in the strategy

function withdrawWETH(address strategy, address router, uint256 amount, uint256 slippage, bytes calldata data) external;
// burns `amount` shares; data = transferFrom(strategy, attacker, amt) per underlying

Oracle path confirmed in the trace: pool.observe(uint32[]) with short, per-pool-varying windows rather than one long window. Combined with an imbalanced FARM V3 pool this over-values FARM by ~9×.

Root cause#

1. Permissionless deposit mints on estimated value, not on a bounded basket of known tokens with haircuts.
2. FARM estimator uses a manipulable / stale-thin TWAP that diverges ~9× from the liquid V2 pool the attacker actually traded.
3. Withdraw pays real reserves (UNI/AAVE/MKR) against those inflated shares.
4. No circuit breaker comparing deposit token's V2 price vs the oracle print.

Preconditions#

• Strategy still holds UNI/AAVE/MKR worth extracting.
• FARM V3 TWAP remains dislocated vs V2.
• 1 ETH of attacker capital (the live tx).

Attack walkthrough#

attacker profit (ETH): 5.277209113875295697
[PASS] testExploit()

Diagrams#

Remediation#

1. Price deposits off the same venue the token is actually liquid on, or min(V2, V3 TWAP) with a long window.
2. Haircut / cap any single item's contribution to valueBefore / amountAddedValue.
3. Whitelist deposit tokens that have deep, consistent oracles; drop FARM-like thin TWAPs.
4. Compare oracle print vs a spot sanity bound and revert on >X% divergence.

How to reproduce#

_shared/run_poc.sh 2026-09-EnsoFinance_exp --mt testExploit -vvvvv

Expected: [PASS] testExploit() with profit > 4 ETH (observed 5.277).

Reference: https://x.com/telemnews/status/2097611731707048169

References#

• https://x.com/SlowMist_Team/status/2097602957311455640 (@SlowMist_Team secondary analysis)

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2026-09-EnsoFinance_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: EnsoFinance_exp.sol.
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• DeFiHackLabs incident explorer: search "Enso Finance strategy vault".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.