Resolv Labs, a decentralized finance (DeFi) protocol offering yield strategies tied to delta-neutral positions on Bitcoin and Ethereum, paused all protocol functions early Sunday after an exploit allowed an attacker to mint approximately 80 million unbacked USR stablecoin tokens. The incident triggered a severe depeg, with USR falling from $1 to as low as $0.025 in certain liquidity pools before partially recovering. The exploit extracted between $23 million and $25 million in value, largely converted into Ether (ETH) and moved across multiple wallets.
Attack Vector: Parameter Manipulation in Two-Step Minting
According to on-chain data and project disclosures, the attacker deposited roughly $100,000 to $200,000 in USDC into a contract tied to USR issuance. Exploiting a two-step minting process, the attacker manipulated parameters within the request and completion flow to mint around 80 million USR — far exceeding the initial deposit. Analysts pointed to weaknesses in a permissioned service role and insufficient validation checks between minting steps. Early assessments suggest the vulnerability may involve an off-chain component, such as a compromised signer or flawed backend validation, rather than a traditional smart contract bug.
After minting the unbacked tokens, the attacker rapidly converted USR into wrapped variants and sold across decentralized exchanges including Curve and Uniswap. The sell-off crashed USR prices, with the token trading as low as a few cents in certain pools. Resolv Labs emphasized that the underlying collateral pool remained intact; no backing assets were drained. The loss stemmed solely from the issuance of unbacked tokens, not from the failure of collateral.
Market Impact and Industry Reaction
The depeg of USR sent shockwaves through the DeFi ecosystem. Several integrated protocols quickly moved to limit exposure, pausing markets or disabling collateral tied to Resolv assets. USR partially recovered later in the day but remained well below $1. Prior to the incident, Resolv Labs had over $500 million in total value locked (TVL), supported by multiple audits, a bug bounty program, and custody integrations. The failure highlights the persistent risks in DeFi, particularly when stablecoin issuance relies on complex multi-step processes and off-chain verification.
Resolv Labs stated that it paused all protocol functions immediately and is investigating recovery options. The team advised users to avoid interacting with affected assets while the review continues. Community reactions have been mixed: some praised the swift response and transparency, while others criticized the protocol for failing to catch the vulnerability despite extensive audits. The incident serves as a stark reminder that even well-audited protocols can suffer catastrophic exploits due to seemingly minor validation gaps.
FAQ: Key Questions Answered
- What caused the USR stablecoin to depeg? An attacker exploited a protocol vulnerability to mint tens of millions of unbacked USR tokens and dumped them on exchanges.
- How much was lost in the Resolv Labs exploit? The attacker extracted an estimated $23 million to $25 million in value, primarily through token sales.
- Were user funds or collateral drained? No, the collateral pool remained intact; the loss resulted from unbacked token issuance and subsequent sell-off.
- Is the Resolv protocol still operational? No, all functions are paused as the team investigates and works on recovery solutions.
The exploit underscores the importance of robust validation mechanisms in DeFi protocols and the need for continuous security improvements. Investors are advised to stay informed about the ongoing situation and exercise caution when interacting with affected assets.