EnsoFinance exploit analysis

An Enso Finance strategy vault on Ethereum was drained of ~5.6 ETH on 2026-09-09 when an attacker inflated the vault's deposit-share mint through a short-window Uniswap V3 TWAP oracle on the FARM estimator (attack transaction, block 25934827). DeFiHackLabs reconstructs the inflation on a mainnet fork.

The vault mints deposit shares using the change in the strategy's oracle-estimated value: mint = amountAddedValue * totalSupply / valueBefore. Valuation runs through EnsoOracle -> per-item estimators -> a Uniswap V3 TWAP (pool.observe). The FARM item was priced off an imbalanced pool whose TWAP window was short enough for the attacker to walk the price far above its real worth inside one window. The inflated valueBefore raised the mint amount to roughly 9x the actual deposit, then the attacker redeemed the inflated shares for the strategy's real underlying tokens (UNI, AAVE, MKR) and sold those for WETH. DeFiHackLabs records the loss as ~5.6 ETH, with the realised PoC figure of 5.277 ETH reflecting slippage selling the looted UNI/AAVE/MKR back to WETH.

The fix is to lengthen the TWAP window for low-liquidity items, or to enforce a maximum deviation between the TWAP price and a fresh slot0 observation before accepting it.