Thetanuts Finance

A deprecated Thetanuts Finance Index Vault was exploited through an integer-division rounding flaw in its mint accounting. Using a flash loan, the attacker reduced the index token supply to a minimal level and repeatedly minted replacement shares while required underlying-token deposits rounded to zero, allowing the attacker to retain assets redeemed from the vault.

499078 USDC plus residual option-token positions. About one hour later, a whitehat used the same vulnerability to secure approximately $2M of assets from another vulnerable legacy vault.