MINTEREST

DESCRIPTION OF EVENTS

"Yield Gets Real. Dollar for dollar Minterest delivers the highest long-term yields in DeFi." "Minterest captures more fees than any other lending protocol and redistributes them as rewards back to users who contribute to its governance with the highest long term yields."

"Made possible by DeFi’s first liquidation engine, Minterest is able to capture significantly more fees than any other protocol." "Using maximised fees, the protocol buys back its native MINTY token to distribute as rewards to users who contribute to governance. In return they receive the highest long term yields in DeFi." "Minterest sophisticated risk prediction engine supports borrowers in protecting their assets. With live alerts, the engine allows effective management of downside risk."

"Minterest is a decentralised lending protocol with a unique economic model. It captures more fees than any other lending protocol and redistributes them as rewards back to users who contribute to to its governance with the highest long term yields."

"As a lending protocol, Minterest allows users to supply, or deposit tokens to its token markets in order to receive interest in return. Users who supply tokens to a token market are known as liquidity providers."

"Liquidity providers may also borrow tokens from any token market, but doing so requires collateral to be provided in the form of tokens supplied to token markets to secure the borrowed amount and the accrual of interest. Users earn Minterest's native governance token (MINTY) as emission rewards for supplying and borrowing token assets, which are known as Standard Rewards."

"Borrowers, when interacting with the protocol contribute fees from their token assets for functions undertaken on their behalf. Minterest captures 100% of the possible fee value contributed by its users; a unique approach to DeFi lending protocols with a purpose of creating a fairer financial experience for its users."

"Though Minterest’s code had been reviewed and fully audited multiple times, the USDY token market addition specific to Mantle Network went live unaudited. To provide greater context, the token markets on Minterest are governed by the audited mToken contract, which directly oversees markets such as USDT, USDC, and mETH. However, certain token markets, like USDY, contain unique properties. For these markets, a new token contract is created, inheriting all traits from the parent mToken contract before adding new functionality. Unfortunately, our internal code review process failed to flag the flaw and requirement for a partial security audit."

"The wallet address was initially funded by Tornado Cash, a mixer, and then used by both Stargate and Squid Router for cross chain transfers to Ethereum Mainnet."

"The attacker exploited the $mUSDY market using a flashLoan and lendRUSDY via a reentrancy attack.

This manipulation allowed them to withdraw more tokens than they should have.

This was done repeatedly, exploiting the market for $1.7M USD."

"In the flashLoan function, funds are transferred to the caller, then the caller’s callback is executed, followed by a transfer of funds back with a fee. These token transfers change the market’s cash balance, which affects the exchange rate. In the callback function, the attacker converted USDY tokens to mUSD and lent them with lendRUSDY.

Because this loan was done between two token transfers inside a flash loan, a lower exchange rate was calculated, and the attacker received more mTokens than they should have. After that, they withdrew all of the underlying tokens.

During the withdrawal action, Minterest burns the amount of mTokens based on the correct exchange rate, thus the attacker withdrew his position but still had a number of unsecured mTokens.

After repeating the operation above in a loop 25 times, they reached the equivalent of $1.7M USD in the USDY market and used it to borrow the maximum possible amount from both the WETH and mETH markets."

"$1.4M has been stolen by a hacker in tokens mETH + WETH"

"We are currently investigating an exploit on Minterest. As a precautionary measure, we have temporarily paused some operations on the Minterest App: Paused: Supply & Borrow Active: Repay & Withdraw"

"No further actions can be taken by the exploiter at this time. We are working diligently to resolve this issue, and full operations will resume shortly."

"A bounty is placed on @ArkhamIntel while we work with forensics teams & law enforcement options to recover the funds."

"Our efforts to address the theft have involved extensive collaboration with forensics experts, centralised exchange partners, and bounty hunters. Although the hacker has not communicated or shown any intention to cooperate, we are committed to pursuing all avenues for recovery. We anticipate a prolonged process but remain steadfast in our efforts."

"In response to the breach, and after considering numerous options and community suggestions, we have developed the following remediation plan to restore Minterest to a stable operational status:

1. 15% Haircut for WETH & mETH: To account for the stolen funds, an approximately 15% haircut will be applied to WETH and mETH supplies. For example, if the WETH supply displayed on your Minterest Dashboard is 1 WETH, your updated balance will be approximately 0.85 WETH.

2. $MINTY Compensation: Users affected by the theft will receive $MINTY tokens equal to their share of the $1.4M stolen. These tokens will be valued at a 25% discount to the listing price (to be determined). 20% of the tokens will be unlocked at the Token Generation Event (TGE), with the remaining 80% vesting linearly over 6 months.

For example, if you lost $3,000, you will receive $MINTY tokens worth $4,000 at the listing price:

Compensation = Loss / (1 - Discount) = $3,000 / (1 - 0.25) = $4,000

Of these, $800 (20%) will be unlocked at TGE, with the rest vesting over 6 months.

This is the fastest vesting schedule among all current Minterest tokenomics buckets.

3. Yield Farming Boost: To aid recovery for those affected, WETH and mETH suppliers with a pre-exploit supply greater than $50 will receive a 40% boost in MNT and MINTY emissions for three months following the reopening. This boost is equivalent to a Level 3 NFT Boost and will override any lower percentage boosts.

4. Recovered Funds: Any funds recovered will be distributed proportionally to affected users in addition to the $MINTY compensation."

SlowMist Hacked - SlowMist Zone (Jul 17)
@Minterest Twitter (Aug 27)
Mantle Transaction Hash (Txhash) Details | Mantle (Aug 27)
@Minterest Twitter (Aug 27)
https://etherscan.io/idm?addresses=0x0820c2782474288bb39ba3a6e4918283d158c1a5,0x618f768af6291705eb13e0b2e96600b3851911d1&type=1 (Aug 27)
@Minterest Twitter (Aug 27)
@Minterest Twitter (Aug 27)
@Satyams246 Twitter (Aug 27)
@Minterest Twitter (Aug 27)
Minterest Remediation Plan: Next Steps for Recovery (Aug 27)
@Minterest Twitter (Aug 27)
@Minterest Twitter (Aug 27)
CEO’s Letter to the Community - Minterest (Aug 27)
Minterest Security Incident Post-Mortem Report (Aug 27)
@Minterest Twitter (Aug 27)

More case studies

Ethena Finance Discord
Server Account Compromise

ReHold Renat Gafarov
Smart Contract Withdrawal