RedSonic Vault Exploited for 9.25 ETH via Complex Flash Loan Operation

A recent exploit on the RedSonic Vault on Ethereum resulted in an attacker draining 9.25 ETH using a complex flash loan operation. ExVulSec, a blockchain security firm, identified and analyzed the incident, highlighting how the vault's dual-asset pricing flaw was compromised.

The attack began with the attacker borrowing 1,139 WETH from Balancer through a flash loan, which provided the necessary capital without tying up their own funds. The flash loan allowed the attacker to register stETH as a new share class within the RedSonic Vault, enabling dual access to the same underlying collateral.

The attacker then deposited 9.34 stETH, artificially inflating the rsvETH price by increasing the raw stETH balance in the vault. With the rsvETH price boosted, the attacker redeemed their shares to receive 1,139.5 ETH, effectively extracting the profit.