Security Incident
Flamincome Smart Contract Vulnerability: $345.90K Reported Loss
Flamincome (legacy contracts of Flamingo Finance) was exploited due to unsafe asset accounting and valuation.
- Reported loss
- $ 345,900
- Attack category
- Smart Contract Vulnerability
Incident Overview
The attacker flash-loaned ~$18M USDT, injected USDP/3CRV LP into the Strategy (treating a permissionlessly injectable Convex BaseRewardPool balance as its own assets and overvaluing it via Curve’s get_virtual_price() in a depegged pool), inflated the VaultYUSDT share price, and redeemed real Aave aUSDT liquidity for ~$345.9K profit.
Sources & References
This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.