$11 000 000 USD

MAY 2021




Iron Finance offers "a Partially-collateralized Stablecoin on the Binance Smart Chain". The iron token is "pegged to $1, partly backed by collateral like BUSD, and partially backed by STEEL. The collateralized ratio (CR), which is the collateralized and algorithmic ratio, depends on the market pricing of IRON. If the market demand for IRON is high, the system can be de-collateralized by decreasing the CR vis-a-vis when the demand is decreased."


"Started at 07:41:39 PM +UTC, May 7, 2021, ValueDeFi’s vSwap contract was exploited to drain a number of pools at the loss of about $11M." "AFFECTED IRON-STEEL 60%-40% vFarm STEEL-BUSD 70%-30% vFarm" "This incident was due to the mis-calculation by the protocol on the adopted weighted constant product invariant for non 50–50 ratio pools. There is no flashloan or price manipulation involved. The consequence of mis-calculated invariant allows for draining of affected pool funds. Currently, the bug has been exploited to attack 9 non 50–50 ratio pools with the estimated loss of $11M."


"Total exploited amount is about 4290 ETH and additional 900k$ in FARM, BAC and BASv2 which already been bridged to ETH." "Value DeFi posted on Telegram explaining that a cloud service (FaaS) upgrade changed the reward rate integer. However, the Iron Finance team was unaware. It updated the pools with a different reward rate integer which is what caused the incident."


"Following the Value DeFi incident which greatly affected our users, we are working tirelessly on rebuilding Iron Finance. Expect to hear from us progress updates on a daily basis as we strive to efficiently and promptly replace Value DeFi products and features. In parallel, we are trying to also keep pace with our Roadmap and other deliverables as planned."


"As you may know by now from following our Telegram group, the first step to re-build our protocol after the attack on ValueDefi is to find a new place for our liquidity pools and farms." "We are going to move our liquidity to PancakeSwap from ValueDefi." "Our farms with ValueDefi will be canceled and we are going to have our farms on our own brand new website, with a new design and interface."

Iron Finance had a couple of liquidity pools which had incorrect "adopted weighted constant product invariants" which caused an attacker to be able to exploit the error and drain funds from the pools.


In general, it is not possible to be 100% certain that a smart contract is safe. Where smart contracts are necessary, community-based insurance can protect investors from the loss of all capital.


A more effective storage mechanism for funds would be an air-gapped multi-signature wallet.


Check Our Framework For Safe Secure Exchange Platforms

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2021 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.