A Missing Line of Code Hands Value DeFi a Second $10M Loss

Value DeFi has now landed on the incident leaderboard twice, becoming the first protocol to repeat the feat. Back in November 2020, the project lost $7,000,000 shortly after publicly promoting its flash-loan defenses. This time, on May 6, 2021, the cause wasn't a loan at all — it was a missing line of code, which the team's own post-mortem attributed to human error during a migration. The loss: $10,000,000. Curiously, the native token $VALUE barely moved in price despite the size of the theft.

According to the official post-mortem, here is how the exploit unfolded:

At 3:22 AM UTC on May 5, 2021, the attacker re-initialized a pool contract, assigning themselves the operator role and setting _stakeToken to a token they labeled HACKEDMONEY. This gave them full control over the pool. From that position, they called governanceRecoverUnsupported() and extracted the original staked asset, a vBSWAP/BUSD LP token.

Next, the attacker removed 10,839.16 units of the vBSWAP/BUSD LP token, burned it, and received 7,342.75 vBSWAP plus 205,659.22 BUSD in return. The vBSWAP was then swapped entirely for 8,790.77 BNB via 1inch. Combining the BNB and BUSD proceeds, the attacker purchased renBTC and routed it through renBridge back to native BTC, ultimately depositing funds at address 1Cm6WGvXQ9EgvvWX5dRsBxE2NvxFjfbcVF. The full sequence of on-chain transfers is publicly verifiable via BscScan.

The technical root cause traced back to the affected pool contract's initialize() function. Under normal circumstances, this function should only ever be callable once, immediately after deployment — but the statement initialized = true; was absent from the code. Without that flag being set, anyone could call initialize() again at any point and reassign themselves as the contract's owner, gaining unrestricted control. As the new owner, the exploiter then invoked governanceRecoverUnsupported(), a function intended for emergency recovery of stuck funds in the event of a bug.

The team explained that the vulnerable profit-sharing vStake pool wasn't built from scratch — it was migrated from an earlier implementation used in the Value DeFi Reserve Fund, which had correctly included the initialization guard. Somewhere in the process of merging that old code into the new contract, the critical line was dropped.

In the end, the only party who profited was the attacker, who walked away with a ten-million-dollar payday without needing to take out a flash loan at all. Value DeFi, meanwhile, secured its second entry on the incident leaderboard.