Worked example · 2024-06

UwU Lend sUSDe oracle thin-input manipulation — Ethereum — 2024-06-10

Loss: approximately $20M extracted from UwU Lend on Ethereum on 2024-06-10, plus a second exploit of approximately $3.6M against the same protocol on 2024-06-13 after a pause-and-resume window. UwU Lend is a Compound v2 / Aave-fork lending protocol on Ethereum operated by the same team that had previously operated the EarningFarm protocol. The drained markets were among UwU's smaller markets where the sUSDe-related collateral / debt accounting depended on a specific oracle-input feed that turned out to be flash-loan-movable through manipulation of the underlying Sushiswap pair providing one of the price inputs.
Recovery: none of material consequence on the on-chain layer for either exploit. Proceeds were laundered through Tornado Cash. The protocol team paused after the June 10 incident, claimed remediation, resumed operations, and was exploited a second time on June 13 in a recurring-target pattern.
OAK Techniques observed: OAK-T9.001 (Oracle / Price-Curve Manipulation) — primary, in the thin-input oracle manipulation sub-class: the sUSDe price used by UwU's collateral / debt accounting depended on a price feed that incorporated a Sushiswap pair as one of its inputs; the Sushiswap pair was thin enough that flash-loan-sized trades could move the input materially, with the result that the consumer-side sUSDe price used for liquidation / borrowing accounting was wrong during the exploit windows. OAK-T9.002 (Flash-Loan-Enabled Exploit) as the working-capital precondition. OAK-T7.001 (Mixer-Routed Hop — proceeds from both the June 10 and June 13 exploits were laundered through Tornado Cash).
Attribution: pseudonymous. No public named-individual attribution. Pre-event funding routed through Tornado Cash; post-event laundering routed through Tornado Cash. There is no public OAK-G01 / state-actor attribution. The same address-cluster was implicated by on-chain forensics in both the June 10 and June 13 exploits.
Key teaching point: post-pause-and-resume re-exploitation by the same attacker against the same protocol — the recurring-target pattern — is a recognised post-2022 OAK pattern that the UwU Lend case is the canonical 2024 worked example for. The defender lesson is that pause-and-resume after an exploit is not a remediation primitive; it is a survival primitive that buys time for actual remediation. If the protocol's resume operation does not address the underlying vulnerability class — including all sub-paths reachable through it — the same attacker, who has already performed the analytical work and demonstrated the operational capability, is structurally positioned to re-exploit. UwU Lend 2024 is the canonical 2024 evidence; the historical precedents are bZx 2020 (re-exploited within weeks after the first incident — see /examples/2020-02-bzx.md) and Cream Finance 2021 (re-exploited multiple times across the year).

Summary

UwU Lend is a Compound v2 / Aave-fork lending protocol on Ethereum operated by the same team behind the prior EarningFarm protocol. Its collateral and debt accounting consumes oracle prices for the underlying assets, including sUSDe (Ethena's staked USDe stablecoin derivative), which had become a relevant DeFi collateral asset in the months leading up to the exploit window.

On 2024-06-10 an attacker exploited UwU Lend by manipulating the sUSDe price feed via flash-loan-driven manipulation of one of the feed's underlying Sushiswap pairs. The attack sequence — per BlockSec, Cyfrin, and SlowMist post-incident write-ups — opened a flash loan, used the flash-loaned capital to push the Sushiswap pair providing one of the sUSDe-related price inputs into a manipulated state, executed liquidations / borrows against UwU markets at the manipulated sUSDe price, unwound the manipulation, and repaid the flash loan with ~$20M of net extraction.

The proximate cause is the same root pattern as Inverse Finance 2022 at /examples/2022-04-inverse-finance.md: the consumer-side sUSDe price was derived from a feed whose input set included a Sushiswap pair thin enough to be moved by flash-loan-sized trades. The consumer-side oracle-output was therefore wrong during the exploit window, and the consumer protocol's collateral / debt accounting executed at the wrong prices. The defender mitigation is well-known — the consumer-side oracle should not depend on a flash-loan-movable input — but the operational reality is that thin-input pairs are common in newer asset markets and their inclusion in oracle-feed-derivation paths is sometimes not flagged before the consumer protocol goes live with the asset.

After the June 10 incident, the UwU Lend team paused the protocol and announced remediation. The protocol resumed operations within days. On 2024-06-13 the same attacker (per on-chain address-cluster forensics) executed a second exploit against the resumed protocol, extracting an additional ~$3.6M before the protocol paused again. The second exploit's specific code path was a related but not identical sub-path under the same underlying oracle-manipulation surface — the resume operation had addressed the specific liquidation-extraction sub-path used in the June 10 incident but had not addressed all sub-paths reachable through the same oracle-input manipulation primitive.

For OAK's purposes the case is a clean T9.001 thin-input oracle-manipulation extraction with a T9.002 flash-loan working-capital precondition. The novel OAK contribution of the worked example is documenting the recurring-target / post-pause-and-resume re-exploitation pattern with a clean 2024 case, alongside the historical precedents bZx 2020 and Cream Finance 2021.

Timeline (UTC)

When	Event	OAK ref
Pre-event	UwU Lend operates Compound v2 / Aave-fork lending markets on Ethereum; sUSDe / Ethena-related markets onboarded as the asset gains DeFi adoption	(T9.001 surface — thin-input feed dependency, latent)
Pre-event	Sushiswap pair providing one of the sUSDe-related price-feed inputs has inventory thin enough to be flash-loan-movable; consumer-side oracle inherits flash-loan-vulnerability	T9.001 surface (latent)
Pre-event	Attacker funds wallet via Tornado Cash; analyses UwU oracle path and identifies flash-loan-movable input; develops exploit transaction sequence	(off-OAK pre-event observation)
2024-06-10 (attack tx window)	Attacker opens flash loan; pushes Sushiswap pair into manipulated state; executes liquidations / borrows against UwU sUSDe-related markets at manipulated price; unwinds manipulation; repays flash loan; extracts ~$20M	T9.001 + T9.002 extraction (first exploit)
2024-06-10 (within hours)	UwU operations team confirms exploit; pauses protocol	(operator response)
2024-06-10 — 2024-06-13	UwU team announces remediation, develops patch for the specific liquidation-extraction sub-path used in the June 10 incident	(operator response, remediation window)
2024-06-12 / 2024-06-13	UwU resumes protocol operations after announced remediation	(resume decision)
2024-06-13 (attack tx window)	Same attacker (per address-cluster forensics) executes second exploit against resumed protocol via a related but not identical sub-path under the same oracle-input manipulation primitive; extracts additional ~$3.6M	T9.001 + T9.002 extraction (second exploit, recurring-target pattern)
2024-06-13 (within hours)	UwU pauses protocol again	(operator response)
2024-06-13 onward	BlockSec, Cyfrin, SlowMist publish post-incident write-ups covering both exploits and the recurring-target framing	(transparency / cohort signal)
Days following	Attacker laundering routes proceeds through Tornado Cash	T7.001 (off this example's framing)
Continuing	UwU Lend protocol effectively discontinued; no public recovery; no civil-forfeiture action	(recovery state)

What defenders observed

The bug class was thin-input oracle manipulation, structurally identical to Inverse Finance 2022. The consumer-side sUSDe price was correct relative to its derivation logic; the derivation included a Sushiswap pair as one of its inputs; the pair was thin enough to be moved by flash-loan-sized trades; the consumer-side oracle output was therefore wrong during the exploit window. The same pattern has fired across the 2020–2024 corpus: Inverse Finance 2022 (Sushiswap INV/WETH pair as oracle input), bZx 2020 (multiple variants), Cream Finance 2021 (yUSD price as oracle input), Mango Markets 2022 (MNGO perp as oracle input — see /examples/2022-10-mango-markets.md), and others. The defender mitigation — do not derive consumer-side oracle outputs from inputs whose pool inventory is comparable to or smaller than reachable flash-loan working capital — is well-known but not uniformly applied. UwU Lend 2024 is the canonical 2024 evidence that the discipline was not fully operational across newer-asset markets.
The recurring-target pattern is the structurally distinctive feature. The same attacker re-exploited the same protocol three days later via a related but not identical sub-path under the same underlying oracle-manipulation primitive. The defender lesson is that pause-and-resume is not a remediation primitive — it is a survival primitive that buys time for actual remediation. Resume operations should require not only that the specific code path used in the prior exploit is patched but also that the full set of sub-paths reachable through the same underlying vulnerability primitive has been audited and mitigated. UwU's June 13 resume operation patched the specific liquidation-extraction sub-path from June 10 but did not address all sub-paths through the same oracle-input manipulation surface.
Attacker attention persistence is operationally meaningful and the recurring-target pattern leverages it. A pseudonymous attacker who has performed the analytical work to identify a vulnerability primitive in a target protocol has invested non-trivial cost in that analysis. After a successful exploit, the attacker has demonstrated capability and sunk-cost-paid analytical work that applies to any related sub-path under the same vulnerability primitive. If the protocol resumes within days without addressing the full primitive surface, the same attacker is structurally positioned to re-exploit at lower marginal cost than the original exploit. UwU Lend 2024 is the canonical 2024 case; bZx 2020 (re-exploited within weeks) and Cream Finance 2021 (re-exploited multiple times across the year — see /examples/2021-10-cream-finance.md) are the historical precedents.
Newly-onboarded asset markets are the highest-priority surveillance targets within a Compound / Aave-fork. The sUSDe-related markets at UwU were relatively new at the time of the exploit; the underlying oracle-feed paths had not gone through the depth of cohort-level review that older, established assets had received. The defender practice the UwU case suggests is treating new-asset onboarding as a discrete cohort-level monitoring event: every new asset market in any production lending protocol should be checked for oracle-input flash-loan-resistance criteria before becoming live for collateral / borrowing accounting.
Detection latency was operator-acceptable for both exploits but recovery was not achieved. UwU paused within hours of each on-chain attack window. By that time the funds were already moving toward Tornado Cash. The protocol-pause primitive on Ethereum protects future drains within the paused surface but does not unwind completed extraction; the standard 2024-EVM-mainnet recover-nothing-via-Tornado-Cash pattern applies — the same shape as Onyx, Li.Fi, WOOFi, Hedgey 2024.

What this example tells contributors writing future Technique pages

T9.001 covers thin-input oracle manipulation as a sub-class and UwU Lend 2024 is the canonical 2024 example. The cohort spans Inverse Finance 2022 (the canonical worked example for the sub-class), Cream Finance 2021, Mango Markets 2022, UwU Lend 2024, and others. The T9.001 technique page should treat thin-input oracle manipulation as a discrete sub-class alongside PMM-curve manipulation (WOOFi 2024 at /examples/2024-03-woofi.md) and AMM constant-product manipulation (bZx 2020 at /examples/2020-02-bzx.md).
The recurring-target / post-pause-and-resume re-exploitation pattern is a cross-cutting OAK pattern that should be made explicit in the corpus. UwU Lend 2024 is the canonical 2024 worked example; bZx 2020 and Cream Finance 2021 are the historical precedents. The Mitigations layer should include a cross-cutting Mitigation entry for resume-operation discipline after exploit: resume should not occur until the full set of sub-paths reachable through the underlying vulnerability primitive has been audited and mitigated, not only the specific code path used in the prior exploit. Worked examples for resume-after-exploit cases should reference UwU as the canonical 2024 case and bZx / Cream Finance as the historical precedents.
Attacker attention persistence is a structural threat-model parameter that defenders should treat as a first-class consideration. The standard threat model assumes that each exploit is a fresh-attacker event; the recurring-target pattern is evidence that this assumption fails for a non-trivial fraction of cases. Defender practice should incorporate the realistic possibility that the same attacker will return after a pause-and-resume, with the full sunk-cost-paid analytical work from the original exploit available at zero marginal cost for re-application against related sub-paths.
New-asset onboarding in lending protocols is a discrete cohort-level monitoring event analogous to new-market deployment in Compound v2 forks. The Sonne Finance and Onyx Protocol cases (/examples/2024-05-sonne-finance.md and /examples/2024-09-onyx.md) established the new-market-deployment surveillance discipline for the Compound v2 fork rounding-error cohort. The UwU Lend case extends the pattern to new-asset-onboarding for the broader oracle-input cohort: every new asset market should be reviewed against the oracle-input flash-loan-resistance criteria before going live. Cohort-level surveillance applies symmetrically.
Pseudonymous attribution is the realistic attribution status for this class. Funding through Tornado Cash, laundering through Tornado Cash, no industry forensics provider has produced a named-individual claim. Same address-cluster across both exploits is the strongest single-case forensic signal but does not constitute named-individual attribution. Contributors should not over-claim attribution simply because the on-chain forensics are detailed.

Public references

[uwulendpostmortem2024] — UwU Lend protocol-side post-incident statement covering the June 10 exploit, the resume decision, and the June 13 second exploit.
[blocksecuwu2024] — BlockSec PhalconHQ forensic analysis of both UwU Lend exploits including transaction-trace breakdown of the Sushiswap-pair manipulation and the consumer-side liquidation-extraction sequences.
[cyfrinuwu2024] — Cyfrin / Solodit post-incident technical write-up emphasising the thin-input oracle manipulation root cause and the recurring-target framing.
[slowmistuwu2024] — SlowMist incident analysis covering funding-source tracking, address-cluster correlation across the two exploits, and Tornado Cash laundering pattern.
[rektuwu2024] — Rekt News public-facing summary framing the case as a thin-input oracle-manipulation exploit with recurring-target second-incident pattern.
[peckshielduwu2024] — PeckShield headline figures and on-chain analytics for both UwU 2024 drains.

Citations

[uwulendpostmortem2024] — Operator post-incident statement; primary source for affected-market identification and resume-decision timeline.
[blocksecuwu2024] — Forensic transaction-trace analysis; primary source for the thin-input oracle-manipulation root cause and address-cluster correlation across both exploits.
[cyfrinuwu2024] — Forensic technical analysis; primary source for the recurring-target framing.
[slowmistuwu2024] — Funding-source tracking and address-cluster correlation; primary source for pseudonymous attribution status with same-attacker-across-exploits evidence.
[rektuwu2024] — Public-facing summary; secondary source for recurring-target framing.
[peckshielduwu2024] — Headline figures and on-chain analytics; primary source for cited $20M (June 10) and $3.6M (June 13) loss figures.

Discussion

UwU Lend 2024 is OAK's canonical case for the recurring-target / post-pause-and-resume re-exploitation cross-cutting OAK pattern, paired with bZx 2020 at /examples/2020-02-bzx.md and Cream Finance 2021 at /examples/2021-10-cream-finance.md as the historical precedents. The case sits at the intersection of an oracle-manipulation Technique surface (T9.001 thin-input sub-class) and an operator-response failure mode (resume-after-exploit without addressing the full vulnerability primitive surface).

The thin-input oracle-manipulation framing is well-established in the OAK corpus by 2024. Inverse Finance 2022 is the canonical worked example for the sub-class (Sushiswap INV/WETH pair as oracle input); Cream Finance 2021 (yUSD price as oracle input); Mango Markets 2022 (MNGO perp as oracle input). UwU Lend 2024 adds the canonical 2024 case to this cohort and extends the cohort framing to newer-asset markets (sUSDe-related collateral types) where oracle-input depth-of-review may not have caught up with adoption pace.

The recurring-target pattern is the analytically distinctive feature. The same attacker re-exploited the same protocol three days later through a related sub-path under the same vulnerability primitive. The defender lesson generalises across the bZx / Cream Finance / UwU Lend cohort: pause-and-resume is a survival primitive, not a remediation primitive; resume should not occur until the full set of sub-paths reachable through the underlying vulnerability primitive has been audited and mitigated; the assumption that "the attacker has moved on" after the first exploit is structurally unreliable when the attacker has demonstrated capability and sunk-cost-paid analytical work that applies to any related sub-path.

Attacker attention persistence is the underlying structural feature that makes the recurring-target pattern worth treating as a first-class threat-model parameter. The standard fresh-attacker-per-event threat model fails for a non-trivial fraction of the OAK corpus; UwU Lend 2024, bZx 2020, and Cream Finance 2021 are the cleanest evidence. Worked examples and the Mitigations layer should incorporate the realistic possibility of attention persistence as a default assumption, particularly for protocols that pause-and-resume rather than wind-down after a major exploit.

For OAK's broader credibility, including UwU Lend 2024 in v0.1 closes two gaps: it adds a 2024 thin-input oracle-manipulation worked example to the T9.001 technique page coverage (alongside the WOOFi 2024 PMM-curve case), and it provides a clean 2024 recurring-target case for the cross-cutting OAK pattern that bZx 2020 and Cream Finance 2021 anchor historically. The case is also operationally informative as the second 2024 protocol-end-of-life case (alongside Sonne Finance 2024) — UwU's effective discontinuation after the June 13 second exploit illustrates that recurring-target pattern outcomes tend toward protocol-end-of-life when the protocol's TVL cannot absorb the cumulative loss across exploits.