SlowMist said Enso Finance’s DPI Strategy Vault lost about 5.6 ETH after an oracle pricing error was exploited. The security firm traced the issue to a flawed valuation path that produced prices close to spot quotes, without a time-weighted average price, or TWAP, consistency check and without price range validation. It also said the Uniswap V3 pool used for valuation had imbalanced liquidity.
According to SlowMist, the attacker swapped 0.683 WETH for 268.42 FARM in a single trade on Uniswap V2. The imbalanced V3 pool then mispriced that trade at 6.3 WETH, roughly 9.2 times the actual value. Using that incorrect valuation, the attacker minted excess vault shares and redeemed them for profit.
Enso later responded on X, saying the contract involved had been deprecated more than four years ago. The team said users had previously been advised to withdraw through official channels including Discord, Twitter and GitHub. Enso added that its current infrastructure does not use those contracts and that the current stack has gone through more than 12 production audits.
SlowMist said Enso Finance’s DPI Strategy Vault lost about 5.6 ETH because of an oracle pricing error.
The security firm said the root cause was a flawed valuation path. That design made pricing close to spot quotes and lacked both a TWAP consistency check and price range validation. It also said the Uniswap V3 pool used for pricing was itself imbalanced in liquidity.
How the exploit worked
According to SlowMist, the attacker swapped 0.683 WETH for 268.42 FARM in a single trade on Uniswap V2. The imbalanced Uniswap V3 pool then valued that swap at 6.3 WETH, about 9.2 times the actual value.
With that incorrect price, the attacker minted excess shares and later redeemed them for profit.
Enso response
Enso said in a post on X that the contract involved had been deprecated more than four years ago. The team said it had previously advised users to withdraw through official channels including Discord, Twitter and GitHub.
Enso also said its current infrastructure does not use those contracts and that the current infrastructure has passed more than 12 production audits.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
