Eminence DeFi flash-loan exploit — Ethereum — 2020-09-28 to 2020-09-29

Summary

Eminence (EMN) was a DeFi gaming / NFT protocol under development by Andre Cronje (the creator of Yearn Finance). In late September 2020, Cronje deployed EMN and eAAVE (a companion token) smart contracts to Ethereum mainnet for testing purposes, without publishing a frontend, an announcement, or user-facing documentation. The contracts were functional — they accepted deposits via the minting function and included the complete token-economic logic — but they were not intended for public use at the time of deployment.

The EMN minting function accepted DAI deposits and minted EMN tokens at an exchange rate determined by the Uniswap LP token price of the EMN/DAI pool. An attacker discovered the deployed contracts via MEV-searcher infrastructure (which monitors the mempool for new contract deployments), analysed the minting logic, and constructed a flash-loan-funded oracle-manipulation attack:

1. Flash-loan DAI from Uniswap.
2. Use a portion of the DAI to buy EMN in the Uniswap pool, driving the EMN price (and the LP token valuation) sharply upward.
3. Deposit the remaining DAI into the EMN minting function at the now-inflated exchange rate, receiving a disproportionately large number of EMN tokens.
4. Sell the EMN tokens back into the Uniswap pool at the inflated price, draining the pool's DAI.
5. Repay the flash loan and exit with the pool's DAI as profit.

The attacker drained approximately $15M in various stablecoins and WBTC. Within hours, the attacker returned approximately $8M to a Yearn Treasury-associated multi-sig address, retaining approximately $7M. The partial-return transaction carried an on-chain message to Andre Cronje, suggesting the attacker wished to signal a "white-hat" frame for the partial return.

The incident established the deployed-but-unannounced-contract-as-attack-surface pattern that recurred across DeFi: any functional contract deployed to mainnet is a live attack surface regardless of whether it has been announced to users, because MEV searcher infrastructure discovers new deployments within blocks of the deployment transaction.

Timeline

When	Event	OAK ref
2020-09-28 evening UTC	Cronje deploys EMN and eAAVE contracts to Ethereum mainnet for testing; no frontend or announcement	T9.001 surface created
2020-09-28 (within hours)	Attacker discovers deployed contracts via MEV infrastructure; constructs flash-loan-funded oracle-manipulation; drains ~$15M	T9.001 + T5.002 execution
2020-09-29 early UTC	Attacker returns ~$8M to Yearn Treasury multi-sig, retains ~$7M	(partial-resolved)
2020-09-29	Cronje publicly discloses incident; confirms contracts were deployed for testing, not meant for public use	(disclosure)

What defenders observed

• Deployment-to-mainnet-is-deployment-to-attack-surface. There is no "stealth mode" for Ethereum mainnet smart contracts — the deployment transaction is visible in the mempool, and MEV searcher infrastructure and automated vulnerability-detection bots scan every newly-deployed contract for exploitable functions within blocks of deployment. A functional contract deployed for "testing" or "pre-announcement" is a live attack surface.
• The MEV searcher infrastructure asymmetry is structural. Sophisticated actors who operate mempool-monitoring and contract-analysis infrastructure have an asymmetric detection advantage over ordinary users who discover contracts via project announcements. The Eminence attacker discovered and exploited the contract surface before the project team's user-facing announcement. This asymmetry is the T17.001 structural surface: the information-asymmetry between MEV infrastructure operators and ordinary DeFi users is the load-bearing primitive.
• Partial-return-as-white-hat-signal is a recurring DeFi pattern. The attacker's return of ~$8M (~53% of proceeds) shares the structural pattern of other DeFi exploits where the attacker returns a portion of proceeds as a "white-hat bounty" signalling gesture. The gesture converts the attacker's legal exposure from "criminal theft" to "grey-hat security research" in the attacker's framing, though it has no formal legal effect.

What this example tells contributors writing future Technique pages

• T9.001 (Oracle Price Manipulation) is the load-bearing technique for Eminence, but the case's structural significance is the deployed-but-unannounced-contract-as-attack-surface pattern, which lives at the T17.001 (MEV/Information-Asymmetry) layer. The oracle-manipulation was the execution primitive; the MEV-searcher detection advantage was the load-bearing information-asymmetry surface that made the attack possible within hours of deployment.
• The Eminence case anchors the DeFi-testing-on-mainnet risk surface. Protocol developers who deploy functional contracts to mainnet for "testing" create a live attack surface that MEV infrastructure will discover before the project's intended user base. The case is the canonical worked example for the "don't test on mainnet with functional contracts" DeFi-security invariant.

Public references

• Andre Cronje. "Eminence — Post-Incident Thread." September 29, 2020 — the canonical project-side disclosure — [cronjeeminence2020].
• Cross-reference: T9.001 (Oracle Price Manipulation) at techniques/T9.001-oracle-price-manipulation.md.
• Cross-reference: T5.002 (Flash Loan Liquidation / Drain) at techniques/T5.002-flash-loan-liquidation-drain.md.

Proposed new BibTeX entries

@misc{cronjeeminence2020,
  author = {{Andre Cronje}},
  title = {Eminence DeFi — Post-Incident Disclosure},
  year = {2020},
  month = sep,
  note = {Project-side disclosure of the ~$15M Eminence flash-loan exploit; deployed-but-unannounced contracts exploited within hours via MEV infrastructure discovery.},
}