FenceTranchePool exploit analysis

A tranche pool tied to Fence Finance and Valinor Digital on Avalanche lost about $1.013 million in USDC in two transactions three minutes apart, either side of UTC midnight on 27 and 28 October 2026. The pool's day settlement books a scheduled principal payment as repaid at every UTC boundary without any USDC moving, and the borrower side is permissionless, so an attacker with no position in the protocol could take the same capital out twice.

What the settlement does

The pool at 0xe25cb545bdd47a8ec2d08001cb5661b00d47621a tracks a facility with a funded principal and an outstanding principal. Its draw routine, selector 0x8e27c105, checks the requested amount against funded principal minus outstanding principal. At the end of each UTC day the pool subtracts a scheduled principal payment from the outstanding principal, and that payment never arrives. The outstanding figure therefore falls without any USDC moving, and the gap between funded and outstanding opens back up, restoring draw capacity that had already been spent. In the reconstruction, the attacker's own setup call sets the scheduled settlement date to 00:00 UTC on 28 October, about three minutes after the first transaction (proof of concept).

The pool's source is not verified on Snowtrace. DeFiHackLabs' reconstruction works from the argument layout decoded out of the two on-chain draw transactions, so the selectors are what the chain shows and the function names are the author's labels.

Two transactions

The attacker sent both transactions from 0x6ff1c3ffa622e1062168f3497a275be9cc2b1246 through a helper contract at 0xf09dcf4ede2a88bd316ff355dfc333a281a57805, on consecutive nonces.

The first, at 23:56:41 UTC on 27 October in block 98,731,443, opens a facility naming the attacker's own contract as borrower, funds the principal with an Aave V3 flash loan on Avalanche, and draws the whole amount straight back out. The flash loan is repaid inside the same call, so that cycle leaves funded principal equal to outstanding principal and costs the attacker only the premium, about 506.68 USDC. The pool's configuration and draw steps each call back into the borrower, and each callback has to approve the step by returning true (first transaction).

The second, at 00:00:03 UTC on 28 October in block 98,731,606, sends the same draw calldata with the same arguments. The UTC day had rolled over in between, so the settlement had already credited the scheduled payment as repaid and the draw passed the check a second time. This time the funds stayed with the attacker, and 1,013,353.611686 USDC left the pool's standing liquidity (second transaction). The reconstruction carries a negative control for the point: without the day rollover the second draw reverts (proof of concept).

What the sources call it

DeFiHackLabs records the loss as about $1.013 million and describes the settlement as subtracting a payment that never arrived (README entry). DeFiLlama files the same incident under Fence Finance, classes it as token and share accounting, records the technique as incorrect share accounting, and puts the loss at $1.01 million (DeFiLlama). DeFiLlama describes the loss as an inflated allocation of vault shares obtained with a flash loan and then redeemed for USDC, where the reconstruction traces it to the settlement crediting a principal payment that never arrived. Both accounts put the flash loan at the entry point and the loss at roughly the same size.