On September 20, 2021 — six days after Vee Finance launched as one of Avalanche's first native lending protocols — a single attacker siphoned approximately $35 million in a single transaction bundle without exploiting a cryptographic flaw or stealing a private key. The vee finance hack was a textbook oracle manipulation defi failure: Vee's smart contracts asked a single Pangolin DEX pool "what is the price of AVAX?" and trusted the answer, even when the attacker had rewritten that answer a few seconds earlier by swapping enough tokens to triple the pool's spot price. With the inflated collateral valuation, the protocol happily let the attacker borrow $26 million in stablecoins plus AVAX, WBTC, and WETH far beyond any legitimate limit. The pools were empty before arbitrageurs restored the price in the next block.
What Vee Finance Was and Why It Got Targeted
Vee Finance launched on September 14, 2021 on the Avalanche C-Chain, riding the Avalanche Rush incentive wave that pushed total value locked past $10 billion that week. The protocol offered familiar lending markets — deposit WAVAX, WETH, or WBTC as collateral, borrow USDT, USDC, or DAI up to a 75% loan-to-value ratio — forked from established Ethereum lending logic but wired to Avalanche-native price data.
Its fatal shortcut was the price feed. Vee Finance priced every collateral market by reading Pangolin, the Uniswap V2 fork that was Avalanche's dominant DEX at the time. The call was simple: pair.getReserves() → price = reserve1 / reserve0. That is a spot price — the instantaneous reserve ratio of one low-liquidity pool. Upstream lending logic assumed the number represented reality:
` collateralValue = collateralAmount × oraclePrice borrowLimit = collateralValue × LTV // e.g., 75% `
Three properties made Vee unusually exposed. First, it was Brand new — six days old, limited battle testing, handling tens of millions in its first week. Second, the oracle was singular — one Pangolin pool per asset, no Chainlink, no time-weighted average price (TWAP), no deviation guard. Third, the pools used were thin — WAVAX/USDT, WETH/USDT, and WBTC/USDT on Pangolin held only ~$1–3 million each, meaning a single large swap could shift the reserve ratio by 200–300% in one transaction.
Timeline: From Launch to Empty Pools in Six Days
The entire life cycle from celebrated launch to post-mortem fits in a week:
September 14, 2021 — Vee Finance deploys on Avalanche mainnet. Markets for AVAX, WETH, WBTC, USDT, USDC, and DAI go live, oracle wired to Pangolin spot reserves. Early TVL builds quickly.
September 14–19 — Normal operation. Deposits and borrows flow, no anomaly detection on oracle deviation or single-block borrow volume.
September 20, ~14:48 UTC — The attacker deploys three exploit contracts, each targeting one Pangolin pair (WAVAX, WETH, WBTC). In a tightly packed transaction bundle, each contract flash-swaps or large-swaps on its Pangolin pool to inflate the collateral price, then immediately calls borrow() on Vee Finance at the inflated valuation. Roughly $35 million leaves the lending pools: ~$26 million in USDT/USDC and ~$9 million in AVAX, WBTC, and WETH.
September 20, late UTC — Vee Finance pauses all contracts, tweets confirmation ("contract attacked, ~$35M stolen"), publishes the attacker address, and asks exchanges and analytics firms to blacklist the funds. AVAX governance forums react within minutes.
September 21, 2021 — SlowMist publishes the first detailed root-cause thread: sole Pangolin oracle dependency, atomic price pump → over-borrow, three pools swept. PeckShield flags the exploit transactions and attacker address independently, confirming the $35M figure and the three-pair pattern.
September 22, 2021 — Vee Finance releases its formal incident report: confirms the single oracle failure, details the manipulation → borrow sequence, and announces a compensation plan — losses to be covered from treasury reserves, locked team token allocations, and future protocol revenue. Trading remains paused.
October 2021 onward — Vee relaunches with a hybrid oracle (Chainlink primary, TWAP fallback, deviation guards) and tighter borrow caps. TVL never recovers to pre-hack levels. Unlike Poly Network's attacker, Vee's attacker never returns funds.
The Numbers: Where $35 Million Came From and Where It Went
At the time of the exploit (AVAX ~$65, ETH ~$3,400, BTC ~$47,000), the $35 million broke down revealingly — the attacker maximized stablecoin extraction, not volatile collateral:
| Asset class | Approx stolen | Notes |
|---|---|---|
| USDT + USDC | ~$26M | Borrowed stablecoins — most liquid exit, no oracle-side friction |
| AVAX (native) | ~$3–4M | Borrowed against inflated WAVAX collateral |
| WETH (bridged) | ~$2–3M | Low-liquidity WETH/USDT pool inflated for the pump |
| WBTC (bridged) | ~$2–3M | Lowest liquidity of the three — highest price distortion per swap dollar |
| DAI / others | remainder | — |
| Total | ~$35M | Quoted as $34–35.6M across sources (price-snapshot variance); often rendered as ~8,800 ETH equivalent |
The cost/return tells the story of oracle leverage:
- Manipulation cost: ~$50,000–$200,000 per pool in slippage and swap fees. Distorting a $2M pool 3x requires ~$2–4M of temporary capital but returns it within the same atomic transaction — net cost is only the fee and the arb-able slippage loss.
- Borrow profit per iteration: A $500,000 collateral deposit inflated 3x to $1.5M at 75% LTV allows ~$1.125M borrow — netting ~$625K after repaying the manipulation cost. Repeating across three pools in one bundle reaches $35M.
- Protocol bad debt: The attacker's collateral position, priced correctly in the next block, is worth far less than the borrowed amount. The position is permanently underwater — but the attacker already holds the borrow; they have no intention of repaying.
- Recovery: $0 returned on-chain. No white-hat negotiation like Poly Network. Vee's team pledged to make users whole from treasury and future revenue; no attacker cooperation was ever announced.
A useful scale: $35 million was small compared to Poly Network's $611M six weeks earlier, yet it was Avalanche's largest lending exploit to date in September 2021 and the second Avalanche oracle failure after Zabu Finance ($3.2M, July 2021) — a pattern that forced Avalanche auditors to treat single-DEX oracles as critical severity.
Root Cause: A Price That Anyone With Capital Could Rewrite
The vee finance hack had no buffer overflow, no reentrancy, and no stolen key. It was a price-feed dependency failure — the protocol outsourced its understanding of reality to a data source the attacker could buy control of for one block.
The Two Contracts That Matter
On Avalanche, Vee Finance consisted of:
- Lending markets (cTokens):
cAVAX,cETH,cBTCfor collateral; USDT/USDC pools holding borrowable liquidity. Each market tracks supply, borrow, and a collateral factor (LTV). - PriceOracle:
PriceOracle.getUnderlyingPrice(cToken)— the single function every market consulted to value collateral. Its implementation called Pangolinpair.getReserves()and computedprice = reserveUSDT / reserveWAVAX.
The intended flow for a legitimate user depositing 1,000 WAVAX to borrow USDT was: deposit 1,000 WAVAX → PriceOracle reads Pangolin WAVAX/USDT spot → 1,000 × $65 = $65,000 collateral value → borrow up to $48,750 at 75% LTV → USDT transferred.
The Two-Step Exploit (Repeated Three Times)
Step 1 — Inflate the answer. In a single atomic transaction, the attacker uses a Pangolin flash swap (Uniswap V2's swap with callback — Avalanche's pre-flash-loan equivalent) or a large funded swap to dump a large amount of USDT into the WAVAX/USDT pool. The pool's WAVAX reserve shrinks, USDT reserve grows, and the reserve ratio now claims WAVAX is worth 2–3x its real price. No TWAP was consulted — only the instant ratio — so the lie was authoritative.
Step 2 — Borrow against the lie. Still within the same transaction (before any arbitrage bot can restore the price), the attacker deposits a modest amount of collateral (e.g., WAVAX) and calls borrow(USDT) for the maximum allowed. Vee Finance reads the inflated oracle price, computes collateralValue = amount × 3× price, and permits a borrow 3x larger than reality. The attacker extracts stablecoins up to that inflated ceiling, draining the lending pools.
Because the entire sequence is atomic — swap, oracle read, borrow — no other transaction can intervene. The price reverts via arbitrage in the next block, but the lending protocol already holds an underwater position: inflated collateral now correctly priced at 1x secures a debt issued at 3x. The attacker never needs to fix the price; they already hold the borrowed funds in their wallet.
This pattern was repeated for WETH/USDT and WBTC/USDT — same oracle bug, three collateral types, three exploit contracts.
Why This Costs One Block, Not a Key Theft
Stealing a private key requires phishing, malware, or insider access — expensive and noisy. Rewriting a spot price on a thin pool requires only capital — one swap fee. The vulnerability violated two cardinal rules of DeFi oracle design:
Never let a lending decision depend on a price writable in a single transaction. Never let one low-liquidity pool be the sole source of truth for hundreds of millions in collateral.
Vee Finance violated both. A Time-Weighted Average Price (TWAP) over 30 minutes on Avalanche (≈300 blocks) would have required the attacker to sustain the inflated price for 300 blocks — 300x the capital and full exposure to arbitrageurs and MEV bots for half an hour — making the $35M extraction economically infeasible. Chainlink's aggregated off-chain price would have ignored the DEX distortion entirely.
The Pangolin Oracle Exploit in Detail
The pangolin oracle exploit is a sub-class of oracle manipulation defi that deserves its own anatomy, because it recurs across chains under different DEX names (Uniswap V2 on Ethereum, PancakeSwap on BSC, Pangolin on Avalanche) with identical structure.
Pangolin's spot exposure: Pangolin, as a Uniswap V2 fork, stores two numbers per pair: reserve0 and reserve1, plus price0CumulativeLast for TWAP. The convenience method getReserves() returns only the instant reserves. Early Pangolin docs and example integrations quoted getReserves() for pricing — and Vee Finance copied that pattern verbatim.
What Vee should have used: Uniswap V2's TWAP via accumulated price (price0CumulativeLast) sampled at two points 30 minutes apart gives a manipulation-resistant median. Better still, Chainlink on Avalanche (live since early 2021) aggregated prices across multiple CEX/DEX sources off-chain — a single DEX pump would be averaged out. The gold standard adopted after: Chainlink primary + TWAP fallback + deviation circuit breaker.
Low-liquidity leverage in numbers: A WAVAX/USDT pool with $2M TVL has ~$1M per side. Swapping $1M USDT for WAVAX at 0.3% fee moves the reserve ratio from ~65 WAVAX/USDT to ~180 — a 2.8x distortion. The slippage loss returning the swap is ~$150K — but the borrow gain at 75% LTV on $500K collateral inflated to ~$1.35M is ~$515K net per cycle. Looping that three times clears $1.5M; scaling collateral and repeating across ETH and BTC markets reaches $35M.
This is why single oracle risk defi scales inversely with pool depth: shallower pool = cheaper to move price = higher borrow leverage per dollar of manipulation. A $50M pool would have cost $25M to move 3x — never profitable for $35M theft.
Borrow-not-swap hides the profit: Unlike DEX manipulation where the attacker must swap the inflated asset back (incurring slippage twice), lending manipulation borrows different assets (stablecoins) against the inflated accounting of collateral. The exit (borrow) has no slippage — the lending protocol delivers USDT directly. The only slippage is on the entry (the pump). That asymmetry makes lending oracle manipulation roughly twice as capital-efficient as pure swap manipulation — which is why Vee ($35M), MonoX ($31M), and Inverse Finance ($1.2M) all used the borrow pattern.
Attacker, Laundering, and Response
The attacker funded the exploit with AVAX for gas bridged from Ethereum/centralized sources, deployed three contracts sequentially (one per Pangolin pair), and executed the manipulation in a transaction bundle flagged by PeckShield at ~14:48 UTC on September 20. The contracts swept ~$35M in stablecoins and WAVAX/WBTC/WETH into attacker EOAs in minutes. Unlike Poly Network's attacker — whose $611M in traceable stables was frozen by Tether and every major exchange, forcing a negotiation — Vee Finance's stolen assets were smaller, included liquid stables that could be bridged off Avalanche quickly, and faced no issuer freeze that was publicly confirmed.
No on-chain return, no white-hat message, and no mixer-level tracing success were publicly disclosed. Vee's team, following the auditor consensus (SlowMist, PeckShield, CertiK all converging on single-oracle root cause), announced a three-pillar compensation plan the next day: treasury reserves, locked team token allocations sold over time, and future protocol fee revenue redirected to affected users. The lending contracts remained paused for weeks; the relaunch introduced:
- Hybrid oracle: Chainlink aggregated price primary, 30-minute TWAP fallback if Chainlink stale or deviant.
- Deviation guards: Borrow reverts if oracle price moved >5% within one block or feeds disagree >2%.
- Borrow caps: Per-block borrowing limits plus a pool-drain circuit breaker (pause if >20% of pool borrowed in one block).
Lessons: 5 Defenses That Would Have Stopped the Vee Finance Hack
Every major oracle-manipulation lending exploit since — MonoX ($31M, Oct 2021), Inverse Finance ($1.2M, Jun 2022), Mango Markets ($100M, Oct 2022) — reproduced Vee's failure: a single manipulable price path to an over-privileged borrow decision.
1. Never use a sole spot price — use TWAP or Chainlink. A 30-minute TWAP median resists single-block manipulation because the attacker must sustain the distortion for hundreds of blocks under arbitrage pressure. Chainlink's off-chain aggregation ignores any single DEX. Vee's post-hack fix (Chainlink primary, TWAP secondary) is the baseline; spot getReserves() is never acceptable for lending.
2. Multi-source median, not single source. Aggregate at least two independent oracles (Chainlink + TWAP median, or three DEX TWAPs) and reject if any source deviates >2%. A single Pangolin pool pumping 3x would then be outvoted by Chainlink's unchanged cross-market median. Single-source price feeds are single points of failure — every lending protocol holding >$10M should treat them as critical risk.
3. Price deviation and staleness guards. Revert any borrow where the oracle price moved >5% since the previous block, or where Chainlink's updatedAt is >1 hour stale. This turns a silent over-borrow into an explicit revert and gives monitoring time to pause. The 5% threshold catches Vee's 200–300% pump while allowing normal volatility.
4. Borrow caps & circuit breakers. Cap borrowing per block (e.g., no more than 15% of pool liquidity per block) and pause the market if more than 20% of pool is drained in one transaction. Even if an attacker inflates price, the cap limits extraction to one slice — requiring sustained manipulation across many blocks, which TWAP already makes infeasible. Volume-based halts are the borrow-side equivalent of a stock exchange circuit breaker.
5. Low-liquidity pair vetting and exclusion. Require a minimum aggregate liquidity (e.g., $10M) for any pair in the oracle universe, or exclude thin pairs entirely. WAVAX/USDT and WBTC/USDT pools on Pangolin at $1–3M never qualified. Had Vee filtered oracle sources by depth, the three manipulated pools would have been rejected as price sources before the first block.
Frequently Asked Questions
How much was stolen in the Vee Finance hack? Approximately $35 million (cited as $34–$35.6M depending on token price snapshots on September 20, 2021), often rendered as ~8,800 ETH equivalent. About $26M was USDT/USDC stablecoins and ~$9M was AVAX, WBTC, and WETH. The attacker drained Vee's lending pools by borrowing far beyond the real value of their collateral after inflating its price via Pangolin pools.
How did the Vee Finance hack work? The attacker used a Pangolin flash swap (Uniswap V2 swap) to inflate the spot price of WAVAX, WETH, and WBTC by 2–3x on thin Pangolin pools in a single transaction. Vee Finance's PriceOracle read that manipulated spot price via getReserves() with no TWAP or Chainlink check, valued the attacker's collateral at 3x reality, and permitted borrowing 3x the legitimate limit. The attacker borrowed ~$35M in stablecoins and AVAX/BTC/ETH, leaving an underwater position — classic oracle manipulation defi via single oracle risk defi.
What is a Pangolin oracle exploit? A pangolin oracle exploit abuses the fact that Pangolin (Avalanche's Uniswap V2 DEX fork) stores spot price as a simple reserve ratio reserve1/reserve0 that anyone can shift with a large swap. If a lending protocol like Vee Finance treats that ratio as authoritative without a TWAP window or Chainlink aggregation, an attacker can inflate the ratio in one block, borrow against the inflated valuation, and keep the borrowed funds after the price reverts. Low-liquidity pools are cheapest to move, giving highest leverage.
Did Vee Finance recover the stolen funds? No on-chain recovery was announced. Unlike Poly Network's attacker who returned ~$611M after traceability made the loot radioactive, Vee Finance's attacker never returned funds. Vee pledged to compensate affected users from treasury reserves, locked team tokens, and future protocol fees — but the $35M itself was not recovered from the attacker at time of writing, and TVL never returned to pre-hack levels.
Was the Vee Finance hack a flash loan attack? Strictly, it was a flash swap (Uniswap V2 swap with callback) rather than an Aave-style flash loan — Avalanche had limited flash-loan infrastructure in September 2021. The distinction matters: the attacker manipulated price by large DEX swaps within the same atomic transaction as the borrow, achieving the same effect as a flash loan — temporary capital to distort price — without a formal flash-loan provider. Security reports describe it as "flash swap + borrow" or "large swap + over-collateralized borrow."
How could the Vee Finance hack have been prevented? Five layers independently block it: (1) Use a 30-minute TWAP or Chainlink aggregated price instead of a single Pangolin spot — one-block manipulation becomes economically infeasible. (2) Medianize two or more independent sources so a single pumped pool is outvoted. (3) Add deviation/staleness guards that revert borrows if price moved >5% in one block. (4) Cap borrows per block and circuit-break on draining volume. (5) Exclude low-liquidity pairs from the oracle set. Any one of these stops the attack; Vee implemented (1)–(4) after the hack.
Conclusion
The vee finance hack endures not because of its size — $35 million has been surpassed many times since — but because it is the purest demonstration of single oracle risk defi. An attacker did not need to break cryptography, steal keys, or find a reentrancy. They needed only to ask what the cheapest fact to rewrite was — the spot price on a shallow Pangolin pool — and to time the borrow to the block where Vee Finance believed the lie. The technical lesson is ruthless: any lending decision that depends on a price writable in one transaction is a price the attacker controls. The industry answer — Chainlink aggregation, TWAP medians, deviation guards, borrow caps, liquidity vetting — is not exotic. It is the dull, multiplicative hardening that separates an oracle that reports reality from an oracle that retails the attacker's fiction for one fatal block.