Thetanuts exploit analysis

Thetanuts index vault shares represent a basket of component vault shares. The attacker at 0x30498e4466789e534c72e03b52a16c978655b41e flash-loaned index vault shares, claimed the corresponding component vault shares, then repeatedly minted replacement index shares while component transfer amounts stayed at zero. The minted shares repaid Aave, and the residual USDC and component shares went to the profit receiver.

The attacker used the historical attack contract 0x0f9daa9e0adced4e64578b2e131930dde54e492e against the Thetanuts issuance vault 0xc2c3ae0a7b405058558c9b4a63b373486cb86ac7.

DeFiHackLabs reports a total loss of about 105,471.50 USDC. The drain is in 0xbba9f138fe39503bfd1aa62932dbd6ab35d37d23d48e4b7bf2988a9d5dc39fec on Etherscan.

What would have prevented it: an index-share mint() that asserts the corresponding component transfer actually moved tokens from the depositor, not just that a zero-amount transfer was permissible.