Background
During the March 15 attack, the attacker donated a large amount of THE tokens directly into the vTHE contract, inflating the internal exchange rate from 1.008e28 to 3.842e28 in a single block and then get pumped to 4.313e28 in the follow-up attack transactions. The rate has since grown slightly to 4.466e28 due to normal interest accrual.
This inflated exchange rate means the vTHE market is not functioning correctly — supply and borrow values are distorted. Our goal is to restore the exchange rate to its fair value (~1.044e28) and clear all THE bad debt (~1,919,129 THE) in one operation.
Why This Matters
The exchange rate determines how much THE each vTHE token can redeem:
exchangeRate = (getCash + totalBorrows - totalReserves) × 1e18 / totalSupply
The attacker inflated getCash by donating THE directly (bypassing the normal supply flow), which increased the numerator without changing the denominator. To fix this, we use the admin function sweepTokenAndSync to remove the excess THE from the contract.
The Plan
Current on-chain state (2026-03-24)
| Metric | Value |
|---|---|
| getCash | 2,102,142 THE |
| totalBorrows | 3,178,412 THE (includes ~1,919,129 bad debt) |
| totalReserves | 183 THE |
| totalSupply | 1,182,321 vTHE |
| Current rate | 4.466e28 (inflated) |
| Target rate | ~1.044e28 (fair) |
Approach: Sweep → Repay Bad Debt → Sweep Again
We cannot sweep all excess THE in one go — the contract only holds 2.1M THE in cash, but we need to remove ~4M to reach the fair rate. The solution is to recycle tokens through bad debt repayment:
| Step | Action | getCash | totalBorrows | In Hand |
|---|---|---|---|---|
| Initial | — | 2,102,142 | 3,178,412 | 0 |
| ① | Sweep all available THE out of the contract | ~0 | 3,178,412 | 2,102,142 |
| ② | Repay bad debt (1,919,129 THE) — tokens flow back into the contract | 1,919,129 | 1,259,283 | 183,013 |
| ③ | Sweep again | ~0 | 1,259,283 | 2,102,142 |
Repaying bad debt does not change the exchange rate (getCash and totalBorrows move by the same amount in opposite directions). It simply recycles tokens back into the pool so we can sweep again.
Result:
- Bad debt: fully cleared
- Exchange rate: drops to ~1.067e28 (within ~2% of fair value, will naturally converge as legitimate borrowers repay over time)
- No additional THE sourcing needed
Impact on Users
Who is affected?
| User Type | Impact |
|---|---|
| Supplied THE + has borrows in Core Pool |  THE collateral USD value will decrease → health factor drops |
| Supplied THE only (no borrows) | No liquidation risk. Redeemable THE returns to normal level. |
| Borrowed THE (collateral is other assets) | Not affected. Borrow balance is valued at oracle price, not exchange rate. |
| No THE positions | Not affected. |
Post-attack suppliers
We compared each post-attack minter’s vTHE balance before the attack (block 86731940) vs current. Only 6.69 vTHE of net new exposure exists across 2 addresses, total potential loss totals ~$3.03.
| Address | vTHE Before | vTHE Now | vTHE Diff | Loss (THE) | Loss (USD) |
|---|---|---|---|---|---|
0x18c14a4f... |
0 | 5.19 | +5.19 | 17.64 | $2.35 |
0x00000000...4bf80 |
0 | 1.50 | +1.50 | 5.10 | $0.68 |
| TOTAL | +6.69 vTHE | 22.74 | $3.03 |
Liquidation risk — full supplier scan
On-chain scan of all 245 current vTHE suppliers (100% coverage against totalSupply). For each, we fetched positions across all 44 active Core Pool markets and simulated the exchange rate drop (4.466e28 → 1.065e28, 4.19x).
- Total suppliers: 245
- Suppliers with borrows: 109
- New HF < 1.0 after fix: 19
Accounts at risk from rate fix (12 accounts)
These accounts are currently healthy (HF > 1.0) but would drop below 1.0 after the exchange rate correction.
| Address | THE Supply USD | Total Borrow USD | Current HF | New HF | Shortfall |
|---|---|---|---|---|---|
0xa322166c... |
$20,586 | $9,003 | 1.2119 | 0.2890 | $6,401 |
0x92ae9d3e... |
$5,275 | $1,001 | 2.8884 | 0.7620 | $238 |
0x66ef68da... |
$1,736 | $960 | 1.6352 | 0.9053 | $91 |
0x957de158... |
$292 | $95 | 1.9143 | 0.6716 | $31 |
0xc526fb73... |
$2,995 | $392 | 4.0486 | 0.9654 | $14 |
0xa832aa5e... |
$0.04 | $0.01 | 4.1320 | 0.9853 | $0.00 |
0x997b86c0... |
$0.00 | $0.00 | 3.7483 | 0.8938 | $0.00 |
0xcc651472... |
$0.00 | $0.00 | 1.3556 | 0.3232 | $0.00 |
0xf869ce13... |
$2.91 | $0.71 | 2.1690 | 0.5172 | $0.34 |
0xd0ede935... |
$2.33 | $0.66 | 2.0171 | 0.5978 | $0.27 |
0x05bcd5f8... |
$0.00 | $0.00 | 1.4732 | 0.3513 | $0.00 |
0x2da583f3... |
$0.09 | $0.03 | 1.6076 | 0.3833 | $0.02 |
| TOTAL | $6,775 |
Risk Mitigation
During the VIP execution, all actions on the THE market will be temporarily paused, including Supply, Borrow, and Liquidation. This ensures no user is adversely affected while the exchange rate is being corrected. Normal operations will resume once the fix is complete and the rate has stabilized.
User Advisory
Who is at risk:
- Users who supplied THE as collateral and have active borrows in the Core Pool. The exchange rate correction will reduce the USD value of your THE collateral, which may lower your health factor.
- Users who only supplied THE with no borrows, or users whose collateral is entirely non-THE assets, are not affected.
What you can do:
- Repay part of your borrows to increase your health factor before the VIP executes
- Add collateral in non-THE assets (e.g. BNB, USDT) to strengthen your position
After the fix:
Our analysis shows the rate correction should not cause liquidations for healthy positions. However, if you believe you have been negatively impacted as a result of this operation, please contact the Venus team. We will review each case individually.