ThetanutsVaultShareRounding exploit analysis
ThetanutsVault rounded the first-deposit mint up, and the attacker walked the inflated share out before the vault's ratio settled. DeFiHackLabs reconstructs the first-deposit share-skim drain.
- Reported loss
- 0.15 WBTC, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-04-20: Vault Share Rounding Manipulation on ThetanutsVaultShareRounding”.
Analysis1 min read
ThetanutsVault's share accounting rounded the deposit ratio up to mint one extra share to the first depositor, and the withdrawal ratio down to pay one fewer shares to the last withdrawer. The attacker exploited the deposit-withdraw cycle to mint one share and walk the inflation out.
DeFiHackLabs reconstructs the sequence against the live state; total loss is captured in the PoC.
What would have prevented it: a deposit-share mint that round-downs the first-deposit ratio, instead of round-up.
Other exploits
- GiddyVaultV3 exploit analysis 23 Apr 2026
- KipseliPropAMM exploit analysis 21 Apr 2026
- JuiceboxREVLoans exploit analysis 20 Apr 2026
- AaveRebalancerCreditDelegation exploit analysis 19 Apr 2026
- XLootStaking exploit analysis 15 Apr 2026
- MONA LisaVault exploit analysis 14 Apr 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
