Ethereum Flash Loan Attack Drains 9.25 ETH from RedSonic Vault

An attacker has exploited a flaw in RedSonic Vault's permissionless asset-registration function to drain 9.25 ETH from Ethereum.

The attack, which used a flash loan mechanism, involved the registration of stETH as a second asset class called rsvstETH.

The attacker deposited 1,130 ETH first, acquiring nearly 99% of all outstanding rsvETH shares, and then inflated the stETH balance by depositing 9.34 stETH directly into the vault.

This artificially pushed up the share price, allowing the attacker to redeem rsvETH for 1,139.5 ETH, resulting in a 9.25 ETH profit.