Reddio loses 9.25 ETH due to double-counting bug in vaults

The blockchain protocol Reddio has fallen victim to a cyberattack in which an attacker stole approximately 9.25 ETH (worth over $23.000). The hack exploited a critical security vulnerability in Reddio’s vault system, allowing the same assets to be counted twice.

In brief:

• Attacker stole approximately 9.25 ETH from Reddio via a flash loan
• Cause: stETH was counted in both the ETH and stETH vaults simultaneously
• Security mechanism against manipulation failed due to insufficient checks

How the attack worked

Security firm SlowMist identified that the issue lay in the way Reddio managed different vaults. An attacker was able to deposit stETH (staked Ethereum) into a vault configured as permissionless, after which these assets were counted in two different pools at the same time: both in the stETH vault and in the ETH vault.

This double counting allowed the attacker to use a flash loan to deploy large amounts of stETH. This artificially inflated the value of rsvETH tokens (the shares in the ETH vault). With this inflated value, the attacker could exchange rsvETH for more ETH than was actually available, and then reclaim the original stETH via the rsvstETH tokens.

Why the defence mechanism failed

Reddio had set a 2% limit on withdrawals to prevent manipulation, but this mechanism proved insufficient. The combination of double counting and the use of a flash loan made it possible to circumvent this restriction.

Security researcher SlowMist traced the attacker via the blockchain and identified several addresses involved, including the attacker’s wallet and the affected vault contracts.