Flamincome exploit analysis
On 2026-09-16, an attacker inflated Flamincome's NAV by ~$595K through a permissionless Convex stakeFor call, then withdrew all from VaultYUSDT for ~$345.9K net profit.
- Reported loss
- ~$345.9K USDT net attacker profit (gross Strategy loss ~$595K in aUSDT+USDT), per DeFiHackLabs
- Logged
- Source
- DeFiHackLabs
Logged as “2026-09-16: Permissionless Convex Stakefor Inflates Strategy Nav And Lets Vaultyusdt Overpay On Withdrawall on Flamincome”.
Analysis1 min read
Flamincome's VaultYUSDT strategy was drained of ~$345,900 net profit on 2026-09-16 when an attacker inflated its reported strategy net asset value (NAV) through a permissionless Convex staking path (attack transaction, block 25990443). DeFiHackLabs reconstructs the NAV inflation on a fork and reproduces the ~$345.9K USDT net profit and the gross ~$595K strategy loss.
VaultYUSDT prices the strategy's withdrawAll payout against Strategy.balance * metapool.get_virtual_price() / 1e30, where Strategy.balance is BaseRewardPool.balanceOf(Strategy). BaseRewardPool.stakeFor(Strategy, amount) is permissionless: any address can stake into the pool on behalf of the Strategy without the Strategy ever depositing anything. The stakeFor call inflates BaseRewardPool.balanceOf(Strategy) by the caller's stake, which feeds straight into the NAV calculation and lets the vault mint inflated shares on the next deposit (computed as amountAddedValue * totalSupply / valueBefore, where valueBefore is the manipulated NAV). After the inflated shares were minted, withdrawAll paid out the strategy's real underlying tokens at the inflated share rate.
The attacker funded the stake with a Morpho flash loan, then repaid it from the withdrawAll proceeds. DeFiHackLabs records a gross Strategy loss of ~$595K in aUSDT+USDT and a net attacker profit of ~$345.9K USDT.
stakeFor should be gated to Strategy only, or excluded from the balance accounting that drives withdrawAll.
Other exploits
- InternetToken exploit analysis 21 Sept 2026
- Artificial Superintelligence Alliance exploit analysis $2.3M
- Likwid exploit analysis 18 Sept 2026
- Nimiq exploit analysis 16 Sept 2026
- PrimeFinance exploit analysis 16 Sept 2026
- Startale exploit analysis 16 Sept 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
