Worked example · 2026-08

USM — redeeming the same position in 64 slices paid more than redeeming it once, because the redemption price was an arithmetic mean over the path rather than a function of the position — USM Protocol (Ethereum) — 2026-08-10

Loss: ~$136K (70.83 ETH) on 2026-08-10 — small in absolute terms and the reason to record it is the mechanism, not the amount. The protocol had not issued a public statement at the time of reporting, and no post-mortem has been published.
OAK Techniques observed: OAK-T9.002 (Flash-Loan-Enabled Exploit — the enabling Technique. The attacker borrowed atomically to call fund() at size, moving USM's internal pricing far enough that the redemption path became profitable. No external market and no oracle were touched. See techniques/T9.002-flash-loan-enabled-exploit.md). OAK-T9.011 (Precision-Loss / Rounding Attack — closest existing class, and an imperfect fit that OAK records with the mismatch stated. The extraction came from splitting one redemption into 64 small defund() calls, each priced by an arithmetic mean that made the sum of the parts worth more than the whole. The T9.011 family covers accounting-math defects whose value accrues across many small transactions, which is exactly the shape here — but the underlying defect is path-dependence in the pricing function, not rounding direction in integer division. See techniques/T9.011-precision-loss-rounding-attack.md, and the T9.011.001 split-invariance forward candidate proposed in TAXONOMY-GAPS.md). OAK-T9.001 (Oracle Price Manipulation) explicitly does not apply: the price the attacker moved was USM's own internal accounting, not a feed.
Attribution: pseudonymous. No named individual or group, no published addresses, and no link to a tracked OAK actor.
Key teaching point: A redemption function must return the same total value whether it is called once or a hundred times — and "average price over the path" quietly violates that. USM priced each defund() against an arithmetic mean, so a large redemption was charged against the full price impact it caused, while sixty-four small redemptions were each charged against a small slice of it. The same FUM position, the same block, two different payouts. This is a testable invariant, not a subtle one: for any position size X and any split X = x₁ + … + xₙ, executing the parts must never pay more than executing the whole, net of fees. It can be asserted in a property-based test, checked by a fuzzer in minutes, and stated as an explicit design requirement for any bonding curve, AMM, vault, or redemption path with size-dependent pricing. The wider point is about which minimalism is safe. USM is deliberately governance-free — no admin, no pause, no parameter knobs — a design that removes an entire family of key- and governance-compromise risks and OAK records several incidents where exactly that family did the damage. But governance-free also means no lever to pull when the maths is wrong: no pause, no fee adjustment, no upgrade, no emergency parameter change. Choosing that trade demands correspondingly heavier pre-deployment proof of the invariants, because the arithmetic is the only control the protocol has.

Summary

USM is a minimalist, decentralised, ETH-backed stablecoin on Ethereum, known for a no-governance design: no admin keys, no pause, no parameters to tune. The system runs two tokens — USM, the stable side, and FUM, the leveraged/funding side. fund() deposits ETH and mints FUM; defund() burns FUM and returns ETH. Both are priced from the protocol's internal state rather than an external oracle.

On 2026-08-10, an attacker used a flash loan to call fund() at a size large enough to move USM's internal pricing, then redeemed the same FUM amount split across 64 small defund() calls rather than one large one. Because the redemption path priced each call using an arithmetic mean, the sequence of small redemptions extracted more ETH than a single equivalent redemption would have permitted. The excess — about 70.83 ETH (~$136K) — was the profit.

Nothing external was manipulated. There was no oracle, no external market, no compromised key, and no governance action. The defect was entirely in how the redemption price responds to being split, and the flash loan served only to make the position large enough for the gap to be worth harvesting.

USM had not issued a public statement at the time of reporting. Public accounts describe this as the first significant exploit against the protocol in 2026.

Timeline (UTC)

When	Event	OAK ref
(standing)	USM's redemption path prices `defund()` by an arithmetic mean, making total payout dependent on how a redemption is split	(standing T9.011 surface)
2026-08-10	Attacker takes a flash loan and calls `fund()` at size, moving USM's internal pricing	T9.002
2026-08-10 (same transaction sequence)	The same FUM amount is redeemed through 64 small `defund()` calls instead of one, extracting more ETH than a single call would allow	T9.011 (split-invariance violation)
2026-08-10	~~70.83 ETH (~~$136K) extracted; flash loan repaid	(outcome)
post-event	No public statement from USM; no post-mortem; governance-free design leaves no pause or parameter lever	(open)

What defenders observed

Pre-event (split-invariance is a property test, and it is cheap). "Executing a position in n parts must not out-earn executing it in one" is directly expressible as a fuzz property over size-dependent pricing paths. Any protocol whose price depends on trade size — bonding curves, AMMs, vault redemptions, mint/burn pairs — should carry this assertion in its test suite (M02, M16).
Pre-event (arithmetic-mean pricing is the specific smell). Averaging start and end prices across a single call charges a large trade for its full impact while charging small trades for slices of theirs. Convexity in the price function then pays for fragmentation. Where an average is used for user-facing pricing, the safe form integrates the actual curve rather than averaging endpoints.
At-event (64 calls in one sequence is a loud, cheap signal). Repeated identical calls to a redemption entrypoint from one address inside a single block or transaction bundle has almost no legitimate population. A per-address, per-block call-count alarm on value-bearing entrypoints catches this shape independently of the underlying maths (M11).
At-event (flash-loan involvement was incidental, not causal). The loan set the position size; it did not create the defect, and a well-capitalised attacker could have done the same unfunded. Treating this as "a flash-loan attack" would point remediation at flash-loan defences that do not close it — the fix is in the pricing function (M16).
Response (no governance means no response). No pause was available, no parameters could be adjusted, and no upgrade path existed. The design deliberately removed the levers that other protocols reach for after an incident, which converts every un-caught arithmetic defect into a permanent one until users exit voluntarily.

Public references

[cryptotimesweek0816] — The Crypto Times, "Crypto Whale Loses $25.6M Again as Weekly Hacks Cross $37M" (the weekly roundup entry: USM Protocol, 2026-08-10, $136K / 70.83 ETH, characterised as a pricing-logic flaw in the defund path lacking "split invariance"; also the mechanism detail — a flash loan used to call fund() and manipulate internal pricing, then the same FUM amount split into 64 small defund() calls extracting more ETH than a single large call, against a redemption function whose arithmetic-mean pricing rewarded exactly that split pattern — plus USM's profile as a minimalist no-governance ETH-backed stablecoin and the absence of any public statement): https://www.cryptotimes.io/2026/08/16/crypto-whale-loses-25-6m-again-as-weekly-hacks-cross-37m/
[slowmistzoneusm2026] — SlowMist Hacked (zone entry, 2026-08-10, USM, $136,000, "Smart Contract Vulnerability"): https://hacked.slowmist.io/

Discussion

USM is worth a corpus slot at $136K because it names an invariant the corpus did not previously have an anchor for. OAK already covers rounding-direction defects (T9.011) and flash-loan enablement (T9.002), but the failure here is neither: the arithmetic is not losing precision, and the loan is not the lever. The property that broke is split invariance — the requirement that a position's value be independent of the number of transactions used to realise it. That property governs a large and growing surface: bonding curves, AMM redemptions, vault share pricing, mint/burn pairs, and any redemption path with size-dependent pricing. It is proposed as T9.011.001 in TAXONOMY-GAPS.md and needs a second independent anchor before promotion; contributors encountering an incident where calling the same function n times beat calling it once should map it there.

The governance question this raises is genuinely two-sided and OAK takes no position on it. Governance-free design eliminates admin-key compromise, malicious upgrades, and hostile proposals — real classes with large anchors in this corpus. It also eliminates every post-incident lever. USM could not pause, could not reprice, and could not upgrade; the only available response was for users to exit. That is a coherent choice, but it changes where the assurance budget must go: a protocol that cannot be corrected after deployment needs its invariants proved before deployment, and split invariance is exactly the kind of property that formal methods and property-based fuzzing find quickly when someone thinks to ask.

The last observation is about severity versus signal. A $136K loss will not appear in any annual ranking, and the temptation is to skip it. But the mechanism generalises far beyond its loss: the same defect in a redemption path holding nine figures pays out nine figures, and the attacker's cost is a flash loan plus 64 calls either way. OAK's inclusion rule follows mechanism novelty rather than headline size, and this is the case that rule exists for.