Set Protocol
Oct 6, 2026
ETHMACOAPY’s actualizeFee() rounded redemption backing upward even when no fee was payable. Attackers donated collateral to trigger recalculation, temporarily acquired Set tokens, then redeemed them for more collateral than they contributed, with the difference coming from existing holders’ backing.
11 WETH.
How the exploit worked
View reproducible PoCa second RebalancingSetTokenV3 vault (ETHMACOAPY) hit by the same permissionless actualizeFee() divCeil rounding, the attacker issues the rebalancing set then donates the residual base set into the vault own backing so the zero-fee recompute bumps unitShares from 12253 to 12264, then redeems the same quantity for more collateral than was deposited, the ~116,000 WETH issue/redeem size supplied fee-free by an Aave-v3-fork flash loan.
Lost: 4.047988247781965824 WETH to the attacker in the first tx (reproduced to the wei) on Ethereum; two independent EOAs drained the ETHMACOAPY rebalancing set ac…
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Token & Share Accounting
- Technique
- Rounding Error
- Attribution
- Unknown
- Chains
Event timeline
- Oct 6, 2026Exploit executed — $22K drained via rounding error
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)