SlowMist says deprecated Enso vault lost about 5.6 ETH in oracle pricing flaw
SlowMist said Enso Finance’s DPI Strategy Vault lost about 5.6 ETH after an oracle pricing error was exploited. The security firm traced the issue to a flawed valuation path that produced prices close to spot quotes, without a time-weighted average price, or TWAP, consistency check and without price range validation. It also said the Uniswap V3 pool used for valuation had imbalanced liquidity. According to SlowMist, the attacker swapped 0.683 WETH for 268.42 FARM in a single trade on Uniswap V2. The imbalanced V3 pool then mispriced that trade at 6.3 WETH, roughly 9.2 times the actual value. Using that incorrect valuation, the attacker minted excess vault shares and redeemed them for profit. Enso later responded on X, saying the contract involved had been deprecated more than four years ago. The team said users had previously been advised to withdraw through official channels including Discord, Twitter and GitHub. Enso added that its current infrastructure does not use those contracts and that the current stack has gone through more than 12 production audits.








