Broken Bancor Math Drains $11M From Value DeFi's vSwap Pools

Value DeFi suffered a third exploit inside a single week. Six months earlier the protocol had lost $7M; three days before this incident it lost $10M; now an additional $11M was gone. Adding to the project's troubles, it emerged that the person presented as the team's "co-founder" had actually been a paid actress. Combined with the recurring code mistakes behind the losses, the protocol's credibility took a severe hit, leaving open the question of whether this would be the last such episode or whether the community would once again look past it.

Roughly $11 million was drained from the vSwap AMM pools. The underlying cause was flawed handling of a complex power() exponentiation function used to compute and enforce the weighted constant product invariant. Every pool lacking a strict 50/50 split between its two assets was vulnerable. Because Uniswap's model only supports even 50/50 pairings, Value DeFi had instead implemented the Bancor formula to support pools with unequal asset weightings — and it was this implementation that broke down.

The reference transaction for the exploit is publicly recorded on BscScan (hash 0x2fd0aaf0bad8e81d28d0ee6e4f4b5cbba693d7d0d063d1662653cdd2a135c2de). The attack proceeded in three steps: first, the attacker transferred a small amount of a second token directly to the pair address. Next, they executed a swap requesting withdrawal of a small quantity of the first token alongside a disproportionately large quantity of the second. Because of how the Bancor formula was incorrectly applied, the contract mistakenly validated this swap as legitimate — the actual root of the exploit.

The tokens drained across the affected pools included: 15,000 BNB, 2,700 FARM, 1,700 BASv2, 8.5 million BDO, 68,300 BUSD, 41,400 MDG, 945,000 VBOND, 1.2 million BAC, and 11,000 FIRO. Credit for identifying the mechanism goes to researcher FrankResearcher.

A more technical breakdown, credited to PeckShield, describes the flaw as follows: the power() routine accepts four inputs — baseN, baseD, expN, and expD — to compute an integer approximation of (baseN/baseD)^(expN/expD) multiplied by 2^precision. Crucially, the function assumes baseN will always be greater than or equal to baseD. In this attack, the pool's swap() function was invoked with deliberately crafted parameters that violated that assumption, allowing the invariant check to pass fraudulently while the pool's funds were siphoned out.

Despite this third appearance on the incident leaderboard, the project's native token recovered somewhat in price following the exploit. Data from Nansen, however, showed the protocol's DEX trading volume in steady decline.

Only hours before this latest breach, the Value DeFi team had publicly reassured users about enhanced security measures on Twitter — reassurances that proved to have no practical effect. Trust in the anonymous development team took a further blow after it was confirmed that the person shown in promotional material as "co-founder" was a paid actress hired via Fiverr. When a user pressed the team on this, the response offered was essentially: the person in the video was cast as a stand-in because a developer happened to share that same alias, and the team coincidentally found an actress with the matching name on Fiverr for the video.

For a protocol now sitting at the bottom of the security rankings among its peers, sympathy for continued mishaps is wearing thin. While the recurring failures are worth mocking, it's the users — not the founders — whose funds are actually at risk each time. If the team intends to keep operating, meaningfully improving security practices rather than continuing to prioritize public messaging and superficial audits would be the minimum expected. Whether the project can respond to that pressure, or whether it should simply wind down its operations to protect remaining users, remains an open question.