{"post_stream":{"posts":[{"id":12941,"name":"Allez Labs","username":"AllezLabs","avatar_template":"/user_avatar/community.venus.io/allezlabs/{size}/3325_2.png","created_at":"2026-03-17T10:32:21.671Z","cooked":"\u003cp\u003e\u003cdiv class=\"lightbox-wrapper\"\u003e\u003ca class=\"lightbox\" href=\"https://community.venus.io/uploads/default/original/2X/e/e1e916f3a8c07feb022645a9f651e61da3e89a69.jpeg\" data-download-href=\"https://community.venus.io/uploads/default/e1e916f3a8c07feb022645a9f651e61da3e89a69\" title=\"Venus Post Mortem\"\u003e\u003cimg src=\"https://community.venus.io/uploads/default/optimized/2X/e/e1e916f3a8c07feb022645a9f651e61da3e89a69_2_690x225.jpeg\" alt=\"Venus Post Mortem\" data-base62-sha1=\"weuP282dcEqViTeDnML62YM4bTb\" width=\"690\" height=\"225\" srcset=\"https://community.venus.io/uploads/default/optimized/2X/e/e1e916f3a8c07feb022645a9f651e61da3e89a69_2_690x225.jpeg, https://community.venus.io/uploads/default/optimized/2X/e/e1e916f3a8c07feb022645a9f651e61da3e89a69_2_1035x337.jpeg 1.5x, https://community.venus.io/uploads/default/optimized/2X/e/e1e916f3a8c07feb022645a9f651e61da3e89a69_2_1380x450.jpeg 2x\" data-dominant-color=\"2A1B27\"\u003e\u003cdiv class=\"meta\"\u003e\u003csvg class=\"fa d-icon d-icon-far-image svg-icon\" aria-hidden=\"true\"\u003e\u003cuse href=\"#far-image\"\u003e\u003c/use\u003e\u003c/svg\u003e\u003cspan class=\"filename\"\u003eVenus Post Mortem\u003c/span\u003e\u003cspan class=\"informations\"\u003e1920×628 85.4 KB\u003c/span\u003e\u003csvg class=\"fa d-icon d-icon-discourse-expand svg-icon\" aria-hidden=\"true\"\u003e\u003cuse href=\"#discourse-expand\"\u003e\u003c/use\u003e\u003c/svg\u003e\u003c/div\u003e\u003c/a\u003e\u003c/div\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eOn March 15, 2026, an attacker executed an attack against the THE (Thena) market on Venus Protocol (BNB Chain). The attack exploited compounding weaknesses: thin liquidity for THE, and a “donation” mechanic in Venus’s Compound-forked architecture that allowed the attacker to bypass the market’s supply cap.\u003c/p\u003e\n\u003cp\u003eThe attacker deposited 53.2 million THE as collateral - 3.67x the 14.5M supply cap - and borrowed approximately $14.9M in assets (CAKE, BNB, WBNB, USDC, BTCB) against the inflated position. The subsequent unwinding and liquidation cascade left Venus with just over ~$2M in bad debt.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch1\u003e\u003ca name=\"incident-timeline-1\" class=\"anchor\" href=\"#incident-timeline-1\"\u003e\u003c/a\u003eIncident Timeline\u003c/h1\u003e\n\u003cp\u003eAll timestamps are UTC. Block references are on BNB Chain.\u003c/p\u003e\n\u003cp\u003e\u003cdiv class=\"lightbox-wrapper\"\u003e\u003ca class=\"lightbox\" href=\"https://community.venus.io/uploads/default/original/2X/7/70e11f24a5cc774885c050d2603e2d9d3b036f9e.png\" data-download-href=\"https://community.venus.io/uploads/default/70e11f24a5cc774885c050d2603e2d9d3b036f9e\" title=\"Attack Flowchart\"\u003e\u003cimg src=\"https://community.venus.io/uploads/default/optimized/2X/7/70e11f24a5cc774885c050d2603e2d9d3b036f9e_2_448x500.png\" alt=\"Attack Flowchart\" data-base62-sha1=\"g6zNs09plEZdQnrgPLqcpdC6Rky\" width=\"448\" height=\"500\" srcset=\"https://community.venus.io/uploads/default/optimized/2X/7/70e11f24a5cc774885c050d2603e2d9d3b036f9e_2_448x500.png, https://community.venus.io/uploads/default/optimized/2X/7/70e11f24a5cc774885c050d2603e2d9d3b036f9e_2_672x750.png 1.5x, https://community.venus.io/uploads/default/optimized/2X/7/70e11f24a5cc774885c050d2603e2d9d3b036f9e_2_896x1000.png 2x\" data-dominant-color=\"E3CDD5\"\u003e\u003cdiv class=\"meta\"\u003e\u003csvg class=\"fa d-icon d-icon-far-image svg-icon\" aria-hidden=\"true\"\u003e\u003cuse href=\"#far-image\"\u003e\u003c/use\u003e\u003c/svg\u003e\u003cspan class=\"filename\"\u003eAttack Flowchart\u003c/span\u003e\u003cspan class=\"informations\"\u003e2100×2340 129 KB\u003c/span\u003e\u003csvg class=\"fa d-icon d-icon-discourse-expand svg-icon\" aria-hidden=\"true\"\u003e\u003cuse href=\"#discourse-expand\"\u003e\u003c/use\u003e\u003c/svg\u003e\u003c/div\u003e\u003c/a\u003e\u003c/div\u003e\u003c/p\u003e\n\u003cdiv class=\"md-table\"\u003e\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003e\u003cstrong\u003eRoles\u003c/strong\u003e\u003c/th\u003e\n\u003cth\u003e\u003cstrong\u003eAddress\u003c/strong\u003e\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eOriginal supplier - the primary attacker address\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://debank.com/profile/0x1a35bd28efd46cfc46c2136f878777d69ae16231\"\u003e0x1a35bd28efd46cfc46c2136f878777d69ae16231\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eAttacker contract\u003c/td\u003e\n\u003ctd\u003e\u003ca href=\"https://debank.com/profile/0x737bc98f1d34e19539c074b8ad1169d5d45da619\"\u003e0x737bc98f1d34e19539c074b8ad1169d5d45da619\u003c/a\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\u003c/div\u003e\u003ch2\u003e\u003ca name=\"phase-1-preparation-june-2025-march-2026-2\" class=\"anchor\" href=\"#phase-1-preparation-june-2025-march-2026-2\"\u003e\u003c/a\u003ePhase 1 - Preparation (June 2025-March 2026)\u003c/h2\u003e\n\u003cp\u003eThe attacker began accumulating a large THE position on Venus over a period of approximately nine months. By March 15, the primary attacker address (0x1a35) held approximately 12.2M vTHE (84% of the 14.5M supply cap) a position that was technically within protocol limits.\u003c/p\u003e\n\u003cp\u003eA wallet (0x7a79…f234) received 7,447 ETH (~$16.29M) in 77 transactions from Tornado Cash between 9 and 1 months ago (\u003ca href=\"https://etherscan.io/tx/0xae5bcff7769a31a0adce95963ac4284dd1b593ccf344be14a3a84d9a8d3769ea\"\u003etypical tx\u003c/a\u003e). The attacker deposited this ETH as collateral on Aave (\u003ca href=\"https://etherscan.io/tx/0x3824e4dda3281fa48d018eb3e388a0bdf608a7d59bcfb8cef82f397b052a2cdf\"\u003etypical tx\u003c/a\u003e), borrowing approximately $9.92M in stablecoins (USDT, DAI, USDC). These funds were dispersed to intermediary addresses to purchase additional THE.\u003c/p\u003e\n\u003ch2\u003e\u003ca name=\"phase-2-initial-attack-1155-utc-3\" class=\"anchor\" href=\"#phase-2-initial-attack-1155-utc-3\"\u003e\u003c/a\u003ePhase 2 - Initial Attack (~11:55 UTC)\u003c/h2\u003e\n\u003cp\u003eThe attacker initiated the core attack in a single transaction by deploying an attack contract.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eAttack transaction:\u003c/strong\u003e \u003ca href=\"https://app.blocksec.com/phalcon/explorer/tx/bsc/0x4f477e941c12bbf32a58dc12db7bb0cb4d31d41ff25b2457e6af3c15d7f5663f\"\u003e\u003ccode\u003e0x4f477e941c12bbf32a58dc12db7bb0cb4d31d41ff25b2457e6af3c15d7f5663f\u003c/code\u003e\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cdiv class=\"lightbox-wrapper\"\u003e\u003ca class=\"lightbox\" href=\"https://community.venus.io/uploads/default/original/2X/4/45d1649d655f627e6f1bc8e15f904dddbbe337a9.png\" data-download-href=\"https://community.venus.io/uploads/default/45d1649d655f627e6f1bc8e15f904dddbbe337a9\" title=\"Initial Attack Transaction\"\u003e\u003cimg src=\"https://community.venus.io/uploads/default/optimized/2X/4/45d1649d655f627e6f1bc8e15f904dddbbe337a9_2_690x324.png\" alt=\"Initial Attack Transaction\" data-base62-sha1=\"9XDzdcLKlW4GVxDcHkuYPdhv11L\" width=\"690\" height=\"324\" srcset=\"https://community.venus.io/uploads/default/optimized/2X/4/45d1649d655f627e6f1bc8e15f904dddbbe337a9_2_690x324.png, https://community.venus.io/uploads/default/optimized/2X/4/45d1649d655f627e6f1bc8e15f904dddbbe337a9_2_1035x486.png 1.5x, https://community.venus.io/uploads/default/optimized/2X/4/45d1649d655f627e6f1bc8e15f904dddbbe337a9_2_1380x648.png 2x\" data-dominant-color=\"FCFCFC\"\u003e\u003cdiv class=\"meta\"\u003e\u003csvg class=\"fa d-icon d-icon-far-image svg-icon\" aria-hidden=\"true\"\u003e\u003cuse href=\"#far-image\"\u003e\u003c/use\u003e\u003c/svg\u003e\u003cspan class=\"filename\"\u003eInitial Attack Transaction\u003c/span\u003e\u003cspan class=\"informations\"\u003e1923×905 81.2 KB\u003c/span\u003e\u003csvg class=\"fa d-icon d-icon-discourse-expand svg-icon\" aria-hidden=\"true\"\u003e\u003cuse href=\"#discourse-expand\"\u003e\u003c/use\u003e\u003c/svg\u003e\u003c/div\u003e\u003c/a\u003e\u003c/div\u003e\u003c/p\u003e\n\u003cp\u003eWithin the constructor of this contract, the following actions were executed atomically:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eExchange rate manipulation via donation:\u003c/strong\u003e Six wallets transferred a combined ~36M THE directly to the vTHE contract, inflating the exchange rate. Among these wallets, 0x1a35 was the existing supplier controlling 84.4% of vTHE supply. The attack contract (0x737b) held no collateral itself but was granted permission to use 0x1a35’s borrowing power.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInitial borrows:\u003c/strong\u003e The attack contract borrowed 1.58M USDC from Venus and immediately re-supplied it back (likely a test of the exploit path). It then borrowed 4.6M THE and transferred it directly to the vTHE market - further inflating the exchange rate.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAsset extraction:\u003c/strong\u003e The attack contract borrowed 910K CAKE and 1,972 BNB.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eThe exchange rate was inflated from 10,086,934,836 → 38,420,106,438 (3.81×). The impact on the original supplier (0x1a35) is shown below. In effect, the donation of ~40.7M THE 10×’d the borrowing power of the existing position.\u003c/p\u003e\n\u003cdiv class=\"md-table\"\u003e\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003e\u003c/th\u003e\n\u003cth\u003eBefore Attack\u003c/th\u003e\n\u003cth\u003eAfter Attack\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eSupply\u003c/td\u003e\n\u003ctd\u003e~12M THE (~$3.30M)\u003c/td\u003e\n\u003ctd\u003eSame vToken amount, now worth ~45M THE (\u0026gt;$12M)\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBorrow\u003c/td\u003e\n\u003ctd\u003e~900K CAKE (~$1.28M)\u003c/td\u003e\n\u003ctd\u003e~900K CAKE (~$1.28M, unchanged)\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBorrowing power remaining\u003c/td\u003e\n\u003ctd\u003e~$0.47M\u003c/td\u003e\n\u003ctd\u003e~$5.08M\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\u003c/div\u003e\u003cp\u003eUsing the stablecoins borrowed via Aave, the attacker was buying THE, and the price was driven from ~$0.26 to nearly $4 on Binance Oracle. Venus’s Resilient Oracle (RedStone as primary, Binance as pivot) initially rejected the spiking price - the BoundValidator reverted for approximately 37 minutes as the Binance feed diverged wildly. As the attacker sustained buy pressure across multiple venues in RedStone’s aggregation, both feeds eventually converged at the elevated level, BoundValidator accepted the price, and the protocol began valuing THE collateral at the manipulated rate.\u003c/p\u003e\n\u003ch2\u003e\u003ca name=\"phase-3-follow-up-attacks-12001242-utc-4\" class=\"anchor\" href=\"#phase-3-follow-up-attacks-12001242-utc-4\"\u003e\u003c/a\u003ePhase 3 - Follow-Up Attacks (~12:00–12:42 UTC)\u003c/h2\u003e\n\u003cp\u003eFollowing the initial attack, both addresses executed follow-up transactions to amplify the position further:\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eOriginal supplier (0x1a35):\u003c/strong\u003e Repeatedly borrowed 100 BNB → swapped to THE with the recipient set directly to the vTHE contract (\u003ca href=\"https://bscscan.com/tx/0x2925520db5e5d1a2854fdd56b068299309c92940ce6b185b37493ecd2e4ab230\"\u003etypical tx\u003c/a\u003e), combining price pumping and exchange rate inflation in a single step.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eAttack contract (0x737b):\u003c/strong\u003e Continued a borrow → swap → donate loop (\u003ca href=\"https://bscscan.com/tx/0x4253a8984929fd932cebd2d99c02c3b4e8304154db239aeae0f1bcf094eca296\"\u003etypical tx\u003c/a\u003e), further inflating the exchange rate and pumping THE’s price in the process.\u003c/p\u003e\n\u003cp\u003eThis drove the supply cap breach progressively higher until it’s peak:\u003c/p\u003e\n\u003cdiv class=\"md-table\"\u003e\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eTime (UTC)\u003c/th\u003e\n\u003cth\u003eTHE Supplied\u003c/th\u003e\n\u003cth\u003evs. 14.5M Supply Cap\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003e11:00\u003c/td\u003e\n\u003ctd\u003e12,234,411\u003c/td\u003e\n\u003ctd\u003e84% - within limits\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e12:00\u003c/td\u003e\n\u003ctd\u003e49,525,348\u003c/td\u003e\n\u003ctd\u003e341% - cap bypassed\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e12:42\u003c/td\u003e\n\u003ctd\u003e53,230,145\u003c/td\u003e\n\u003ctd\u003e367% - peak before liquidation\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\u003c/div\u003e\u003cp\u003eTHE’s price was pushed to ~$0.51 when the attack stopped. At peak (block 86738236, 12:42 UTC), the positions stood at:\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eOriginal supplier (0x1a35):\u003c/strong\u003e\u003c/p\u003e\n\u003cdiv class=\"md-table\"\u003e\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eSide\u003c/th\u003e\n\u003cth\u003eAsset\u003c/th\u003e\n\u003cth\u003eAmount (Token)\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eSupply (collateral)\u003c/td\u003e\n\u003ctd\u003eTHE\u003c/td\u003e\n\u003ctd\u003e53,230,145\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBorrow\u003c/td\u003e\n\u003ctd\u003eCAKE\u003c/td\u003e\n\u003ctd\u003e6,669,112\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBorrow\u003c/td\u003e\n\u003ctd\u003eBNB\u003c/td\u003e\n\u003ctd\u003e2,801\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBorrow\u003c/td\u003e\n\u003ctd\u003eWBNB\u003c/td\u003e\n\u003ctd\u003e1,972\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBorrow\u003c/td\u003e\n\u003ctd\u003eUSDC\u003c/td\u003e\n\u003ctd\u003e1,581,461\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBorrow\u003c/td\u003e\n\u003ctd\u003eBTCB\u003c/td\u003e\n\u003ctd\u003e20\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\u003c/div\u003e\u003cp\u003e\u003cstrong\u003eAttack contract (0x737b):\u003c/strong\u003e\u003c/p\u003e\n\u003cdiv class=\"md-table\"\u003e\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eSide\u003c/th\u003e\n\u003cth\u003eAsset\u003c/th\u003e\n\u003cth\u003eAmount (Token)\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eSupply (collateral)\u003c/td\u003e\n\u003ctd\u003eUSDC\u003c/td\u003e\n\u003ctd\u003e1,581,455\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBorrow\u003c/td\u003e\n\u003ctd\u003eTHE\u003c/td\u003e\n\u003ctd\u003e4,628,904\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\u003c/div\u003e\u003ch2\u003e\u003ca name=\"phase-4-collapse-and-liquidation-1242-utc-onward-5\" class=\"anchor\" href=\"#phase-4-collapse-and-liquidation-1242-utc-onward-5\"\u003e\u003c/a\u003ePhase 4 - Collapse and Liquidation (~12:42 UTC onward)\u003c/h2\u003e\n\u003cp\u003eThe attacker’s health factor was driven close to 1. When selling pressure overwhelmed the thin bid-side liquidity, THE’s price collapsed to ~$0.22 (below the pre-attack level) as both liquidation bots and panicked holders sold into the crash.\u003c/p\u003e\n\u003cp\u003eCascading liquidations unwound approximately 42M THE in collateral. While liquidators recovered partial value, the gap between the nominal collateral valuation and realizable market value left the protocol with ~$2.18M in bad debt (primarily denominated in CAKE and THE).\u003c/p\u003e\n\u003cp\u003eThe positions ended at:\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eOriginal supplier (0x1a35):\u003c/strong\u003e\u003c/p\u003e\n\u003cdiv class=\"md-table\"\u003e\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eSide\u003c/th\u003e\n\u003cth\u003eAsset\u003c/th\u003e\n\u003cth\u003eAmount (Token)\u003c/th\u003e\n\u003cth\u003eAmount ($)\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eSupply (collateral)\u003c/td\u003e\n\u003ctd\u003eTHE\u003c/td\u003e\n\u003ctd\u003e0.6\u003c/td\u003e\n\u003ctd\u003e$0\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBorrow\u003c/td\u003e\n\u003ctd\u003eCAKE\u003c/td\u003e\n\u003ctd\u003e1,184,089\u003c/td\u003e\n\u003ctd\u003e$1,792,379\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\u003c/div\u003e\u003cp\u003e\u003cstrong\u003eAttack contract (0x737b):\u003c/strong\u003e\u003c/p\u003e\n\u003cdiv class=\"md-table\"\u003e\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eSide\u003c/th\u003e\n\u003cth\u003eAsset\u003c/th\u003e\n\u003cth\u003eAmount (Token)\u003c/th\u003e\n\u003cth\u003eAmount ($)\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eSupply (collateral)\u003c/td\u003e\n\u003ctd\u003eUSDC\u003c/td\u003e\n\u003ctd\u003e0.16\u003c/td\u003e\n\u003ctd\u003e$0\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBorrow\u003c/td\u003e\n\u003ctd\u003eTHE\u003c/td\u003e\n\u003ctd\u003e1,846,476\u003c/td\u003e\n\u003ctd\u003e$358,585\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\u003c/div\u003e\u003ch1\u003e\u003ca name=\"root-cause-analysis-6\" class=\"anchor\" href=\"#root-cause-analysis-6\"\u003e\u003c/a\u003eRoot Cause Analysis\u003c/h1\u003e\n\u003cp\u003eThe exploit combined three factors:\u003c/p\u003e\n\u003ch2\u003e\u003ca name=\"h-1-supply-cap-bypass-via-donation-mechanic-7\" class=\"anchor\" href=\"#h-1-supply-cap-bypass-via-donation-mechanic-7\"\u003e\u003c/a\u003e1. Supply Cap Bypass via Donation Mechanic\u003c/h2\u003e\n\u003cp\u003eVenus’s architecture allows direct token transfers to market contracts (e.g., vTHE). These “donations” increase the contract’s token balance and by extension, the recognized collateral - without passing through the \u003ccode\u003emint\u003c/code\u003e pathway where supply caps are enforced.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eThe vulnerable code path:\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eIn the vToken contract, \u003ccode\u003egetCashPrior()\u003c/code\u003e reads the underlying token balance directly:\u003c/p\u003e\n\u003cpre data-code-wrap=\"solidity\"\u003e\u003ccode class=\"lang-solidity\"\u003e// VBep20.sol — Venus Protocol core pool\n// https://github.com/VenusProtocol/venus-protocol/blob/develop/contracts/Tokens/VTokens/VBep20.sol#L245\n\nfunction getCashPrior() internal view override returns (uint) {\n    return IERC20(underlying).balanceOf(address(this));\n}\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eThis value feeds into the exchange rate calculation where the exchange rate is equal to the total borrowed, minus the total reserves plus the total cash (balanceOf the contract).\u003c/p\u003e\n\u003cpre data-code-wrap=\"solidity\"\u003e\u003ccode class=\"lang-solidity\"\u003e// VToken.sol — exchangeRateStoredInternal()\n// https://github.com/VenusProtocol/venus-protocol/blob/develop/contracts/Tokens/VTokens/VToken.sol#L1853\n\nfunction exchangeRateStoredInternal() internal view virtual returns (MathError, uint) {\n    uint _totalSupply = totalSupply;\n    if (_totalSupply == 0) {\n        return (MathError.NO_ERROR, initialExchangeRateMantissa);\n    } else {\n        // exchangeRate = (totalCash + totalBorrows - totalReserves) / totalSupply\n        uint totalCash = _getCashPriorWithFlashLoan();\n        uint cashPlusBorrowsMinusReserves;\n        Exp memory exchangeRate;\n        MathError mathErr;\n\n        (mathErr, cashPlusBorrowsMinusReserves) = addThenSubUInt(\n            totalCash, totalBorrows, totalReserves\n        );\n        // ...\n        (mathErr, exchangeRate) = getExp(cashPlusBorrowsMinusReserves, _totalSupply);\n        return (MathError.NO_ERROR, exchangeRate.mantissa);\n    }\n}\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eHowever, supply caps are only enforced in the mintAllowed function - the Comptroller’s gateway for normal deposits:\u003c/p\u003e\n\u003cpre data-code-wrap=\"solidity\"\u003e\u003ccode class=\"lang-solidity\"\u003e// PolicyFacet.sol — mintAllowed()\n// https://github.com/VenusProtocol/venus-protocol/blob/develop/contracts/Comptroller/Diamond/facets/PolicyFacet.sol#L33\n\nfunction mintAllowed(address vToken, address minter, uint256 mintAmount) external returns (uint256) {\n    // ...\n    uint256 supplyCap = supplyCaps[vToken];\n    require(supplyCap != 0, \"market supply cap is 0\");\n\n    uint256 vTokenSupply = VToken(vToken).totalSupply();\n    Exp memory exchangeRate = Exp({ mantissa: VToken(vToken).exchangeRateStored() });\n    uint256 nextTotalSupply = mul_ScalarTruncateAddUInt(exchangeRate, vTokenSupply, mintAmount);\n    require(nextTotalSupply \u0026lt;= supplyCap, \"market supply cap reached\");\n    // ...\n}\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003e\u003cstrong\u003eThe gap:\u003c/strong\u003e When THE is transferred directly to the vTHE contract (bypassing \u003ccode\u003emint\u003c/code\u003e), \u003ccode\u003egetCashPrior()\u003c/code\u003e reflects the higher balance, inflating the \u003ccode\u003eexchangeRate\u003c/code\u003e. But \u003ccode\u003emintAllowed()\u003c/code\u003e is never called, so the supply cap is never checked. After the donation of ~36M THE, the exchange rate inflated 3.81× (from 10,086,934,836 to 38,420,106,438), meaning the same vToken holdings were now worth dramatically more, enabling the attacker to borrow far beyond what the supply cap was designed to allow.\u003c/p\u003e\n\u003cp\u003eThis vector was identified in a prior \u003ca href=\"https://code4rena.com/reports/2023-05-venus\"\u003eCode4rena audit (2023-05-venus)\u003c/a\u003e but was assessed as having “no negative side effects” and was not remediated.\u003c/p\u003e\n\u003ch2\u003e\u003ca name=\"h-2-illiquid-collateral-price-manipulation-8\" class=\"anchor\" href=\"#h-2-illiquid-collateral-price-manipulation-8\"\u003e\u003c/a\u003e2. Illiquid Collateral + Price Manipulation\u003c/h2\u003e\n\u003cp\u003eTHE’s Resilient oracle (RedStone as primary, Binance as pivot) reflected aggregated prices. During the manipulation window, the BoundValidator repeatedly rejected the price, the ResilientOracle reverted for ~37 minutes while Binance spiked wildly. Both feeds eventually converged at the elevated level when the BoundValidator accepted it as valid.\u003c/p\u003e\n\u003ch2\u003e\u003ca name=\"h-3-concentration-risk-in-isolated-markets-9\" class=\"anchor\" href=\"#h-3-concentration-risk-in-isolated-markets-9\"\u003e\u003c/a\u003e3. Concentration Risk in Isolated Markets\u003c/h2\u003e\n\u003cp\u003eThe attacker was able to accumulate ~84% of the supply cap over nine months. In a low-liquidity market it is not infrequent, but this level of concentration can offer preconditions for manipulation.\u003c/p\u003e\n\u003ch1\u003e\u003ca name=\"impact-assessment-10\" class=\"anchor\" href=\"#impact-assessment-10\"\u003e\u003c/a\u003eImpact Assessment\u003c/h1\u003e\n\u003ch2\u003e\u003ca name=\"financial-11\" class=\"anchor\" href=\"#financial-11\"\u003e\u003c/a\u003eFinancial\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eBad debt:\u003c/strong\u003e ~$2.15M (1.18M CAKE + 1.84M THE equivalent, unpaid). To be covered by the protocol.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTHE price impact:\u003c/strong\u003e ~$0.26 → nearly $4 on Binance oracle, ~$0.51 redstone resilient oracle → ~$0.22 (post-liquidation), representing a ~15% intraday decline from pre-attack levels\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca name=\"operational-12\" class=\"anchor\" href=\"#operational-12\"\u003e\u003c/a\u003eOperational\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLimited to the THE and CAKE markets\u003c/li\u003e\n\u003cli\u003eIn an abundance of caution BCH, LTC, UNI, AAVE, POL, FIL, TWT, lisUSD markets have had their CF set to 0.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca name=\"attacker-profit-13\" class=\"anchor\" href=\"#attacker-profit-13\"\u003e\u003c/a\u003eAttacker Profit\u003c/h2\u003e\n\u003cp\u003eOn-chain analysis indicates the attack was unprofitable on-chain - the attacker’s collateral was liquidated at depressed prices, and traceable wallet flows show no net gain. The strategy could include independent wallets or CEX accounts, to long/short THE. We are coordinating with exchanges and forensic partners to pursue this line of investigation.\u003c/p\u003e\n\u003ch1\u003e\u003ca name=\"remediation-14\" class=\"anchor\" href=\"#remediation-14\"\u003e\u003c/a\u003eRemediation\u003c/h1\u003e\n\u003ch2\u003e\u003ca name=\"immediate-completed-15\" class=\"anchor\" href=\"#immediate-completed-15\"\u003e\u003c/a\u003eImmediate (Completed)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePaused borrowing and withdrawals in affected markets\u003c/li\u003e\n\u003cli\u003eSet CF = 0 in potentially at risk markets as a precautionary measure\u003c/li\u003e\n\u003cli\u003eAttacker addresses flagged and shared with forensic partners\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eConcentration monitoring:\u003c/strong\u003e Automated flagging of wallets approaching significant fractions of supply caps\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca name=\"short-term-in-progress-16\" class=\"anchor\" href=\"#short-term-in-progress-16\"\u003e\u003c/a\u003eShort-Term (In Progress)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eDonation mechanic hardening:\u003c/strong\u003e Enforce supply cap checks on all balance increases to the market contract, not only the \u003ccode\u003emint\u003c/code\u003e pathway\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCollateral factor and parameter audit:\u003c/strong\u003e Reduce collateral factors for illiquid assets; introduce more conservative liquidity-weighted calibrations. All market configurations and collateral parameters, with potential delistings\u003c/li\u003e\n\u003cli\u003eGovernance proposal (VIP) for bad debt resolution\u003c/li\u003e\n\u003cli\u003eCoordination with law enforcement on Tornado Cash-sourced funding, and CEX KYD’d activity\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca name=\"mid-term-planned-17\" class=\"anchor\" href=\"#mid-term-planned-17\"\u003e\u003c/a\u003eMid-Term (Planned)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eA complete re-audit for the whole core pool\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e\u003ca name=\"key-takeaways-18\" class=\"anchor\" href=\"#key-takeaways-18\"\u003e\u003c/a\u003eKey Takeaways\u003c/h1\u003e\n\u003cp\u003e\u003cstrong\u003eNominal collateral value ≠ realizable liquidation value.\u003c/strong\u003e When collateral has no real liquidity, the protocol may recognize $30M market capitalisation on paper while the market can only absorb a fraction. This fundamental mismatch is the economic vulnerability that oracle manipulation attacks exploit.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eAudit findings require follow-through.\u003c/strong\u003e The donation bypass was flagged but dismissed. In adversarial environments, any mechanism that circumvents a safety parameter must be treated as a potential attack vector, regardless of whether an immediate exploit path is apparent at audit time.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eIlliquid collateral demands proportionally stricter parameters.\u003c/strong\u003e Supply caps, collateral factors, and oracle configurations must be aligned to latest realizable market depth.\u003c/p\u003e\n\u003ch1\u003e\u003ca name=\"conclusion-19\" class=\"anchor\" href=\"#conclusion-19\"\u003e\u003c/a\u003eConclusion\u003c/h1\u003e\n\u003cp\u003eThe March 15 THE market manipulation was a sophisticated, premeditated attack that exploited a known architectural gap in supply cap enforcement. The ~$2M in bad debt is being addressed through governance.\u003c/p\u003e\n\u003cp\u003eWe are continuing our investigation alongside Venus and security partners.\u003c/p\u003e\n\u003cp\u003eAll updates will be shared through official \u003ca href=\"https://x.com/VenusProtocol\"\u003e@VenusProtocol\u003c/a\u003e channels and \u003ca href=\"https://x.com/AllezLabs\"\u003e@AllezLabs\u003c/a\u003e.\u003c/p\u003e","post_number":1,"post_type":1,"updated_at":"2026-03-26T09:26:35.987Z","reply_count":0,"reply_to_post_number":null,"quote_count":0,"incoming_link_count":796,"reads":32,"readers_count":31,"score":4031.4,"yours":false,"topic_id":5712,"topic_slug":"the-market-incident-post-mortem","display_username":"Allez Labs","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"version":2,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"link_counts":[{"url":"https://debank.com/profile/0x1a35bd28efd46cfc46c2136f878777d69ae16231","internal":false,"reflection":false,"title":"DeBank | Your go-to portfolio tracker for Ethereum and EVM","clicks":25},{"url":"https://app.blocksec.com/phalcon/explorer/tx/bsc/0x4f477e941c12bbf32a58dc12db7bb0cb4d31d41ff25b2457e6af3c15d7f5663f","internal":false,"reflection":false,"clicks":21},{"url":"https://debank.com/profile/0x737bc98f1d34e19539c074b8ad1169d5d45da619","internal":false,"reflection":false,"title":"DeBank | Your go-to portfolio tracker for Ethereum and EVM","clicks":20},{"url":"https://x.com/VenusProtocol","internal":false,"reflection":false,"clicks":10},{"url":"https://etherscan.io/tx/0xae5bcff7769a31a0adce95963ac4284dd1b593ccf344be14a3a84d9a8d3769ea","internal":false,"reflection":false,"clicks":10},{"url":"https://code4rena.com/reports/2023-05-venus","internal":false,"reflection":false,"title":"Code4rena | Keeping high severity bugs out of production","clicks":9},{"url":"https://etherscan.io/tx/0x3824e4dda3281fa48d018eb3e388a0bdf608a7d59bcfb8cef82f397b052a2cdf","internal":false,"reflection":false,"clicks":5},{"url":"https://bscscan.com/tx/0x2925520db5e5d1a2854fdd56b068299309c92940ce6b185b37493ecd2e4ab230","internal":false,"reflection":false,"clicks":3},{"url":"https://bscscan.com/tx/0x4253a8984929fd932cebd2d99c02c3b4e8304154db239aeae0f1bcf094eca296","internal":false,"reflection":false,"clicks":3},{"url":"https://x.com/AllezLabs","internal":false,"reflection":false,"clicks":2},{"url":"https://community.venus.io/uploads/default/original/2X/7/70e11f24a5cc774885c050d2603e2d9d3b036f9e.png","internal":true,"reflection":false,"clicks":0},{"url":"https://community.venus.io/uploads/default/original/2X/e/e1e916f3a8c07feb022645a9f651e61da3e89a69.jpeg","internal":true,"reflection":false,"clicks":0},{"url":"https://community.venus.io/uploads/default/original/2X/4/45d1649d655f627e6f1bc8e15f904dddbbe337a9.png","internal":true,"reflection":false,"clicks":0},{"url":"https://community.venus.io/t/multi-chain-patch-fix-for-the-market-donation-attack/5718","internal":true,"reflection":true,"title":"[Multi-chain] Patch Fix for THE Market Donation Attack","clicks":1},{"url":"https://community.venus.io/t/bnb-chain-the-market-bad-debt-repayment/5719","internal":true,"reflection":true,"title":"[BNB Chain] THE Market Bad Debt Repayment","clicks":1},{"url":"https://community.venus.io/t/bnb-chain-venus-2026-h1-review/5874/15","internal":true,"reflection":true,"title":"[BNB Chain] Venus 2026 H1 Review","clicks":0},{"url":"https://community.venus.io/t/bnb-chain-venus-2026-h1-review/5874/3","internal":true,"reflection":true,"title":"[BNB Chain] Venus 2026 H1 Review","clicks":0}],"read":true,"user_title":"","bookmarked":false,"actions_summary":[{"id":2,"count":4}],"moderator":false,"admin":false,"staff":false,"user_id":2420,"hidden":false,"trust_level":3,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false},{"id":12944,"name":"Remember_the_name","username":"Remember","avatar_template":"/letter_avatar_proxy/v4/letter/r/ecccb3/{size}.png","created_at":"2026-03-18T01:31:37.136Z","cooked":"\u003cp\u003eThe Post-Mortem transparently addresses the THE exploit, including bad debt remediation, but it does not resolve user liquidations. I was personally liquidated for six figures USD due to protocol-level failures acknowledged in the report.\u003c/p\u003e\n\u003cp\u003eCompensating these liquidations is both ethically correct and strategically imperative:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\n\u003cp\u003eTrust and Reputation:\u003cbr\u003e\nVenus’s leading position in DeFi depends on user confidence that funds are safe within promised parameters (such as the supply cap). Failing to compensate affected users signals the opposite.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eCost-effective Brand Investment.\u003cbr\u003e\nTotal losses from liquidations due to THE exploit are likely small relative to the broader ecosystem. Using the Risk Fund to make users whole is a low-cost way to reinforce trust and loyalty.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLong-Term ROI\u003cbr\u003e\nPublicly addressing protocol failures with fair compensation strengthens Venus’s reputation, attracting new users and retaining current ones. Ignoring this risk incentivizes users o seek safer alternatives.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eIn short, compensating users is not a loss. It’s a strategic investment in the protocol’s credibility, growth, and market leadership. Acting now sends a clear signal that Venus honors it commitmens even when the protocol fails.\u003c/p\u003e\n\u003cp\u003eI urge you to consider this path to maintain both ethical standards and market confidence.\u003c/p\u003e","post_number":3,"post_type":1,"updated_at":"2026-03-18T01:31:37.136Z","reply_count":0,"reply_to_post_number":2,"quote_count":0,"incoming_link_count":10,"reads":21,"readers_count":20,"score":69.2,"yours":false,"topic_id":5712,"topic_slug":"the-market-incident-post-mortem","display_username":"Remember_the_name","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"reply_to_user":{"username":"Remember","name":"Remember_the_name","avatar_template":"/letter_avatar_proxy/v4/letter/r/ecccb3/{size}.png"},"bookmarked":false,"actions_summary":[{"id":2,"count":1}],"moderator":false,"admin":false,"staff":false,"user_id":2449,"hidden":false,"trust_level":0,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false},{"id":12948,"name":"DArk Gon","username":"DarkVirgin","avatar_template":"/letter_avatar_proxy/v4/letter/d/eb9ed0/{size}.png","created_at":"2026-03-18T17:50:42.483Z","cooked":"\u003cp\u003eAs another victim of this exploit, I really hope the team does the right thing and compensates those affected by this event.\u003c/p\u003e\n\u003cp\u003eLet’s be very clear: this was not a regular organic market event. The $THE pump was only possible because of the supply and borrow looping mechanics on Venus. It was a targeted exploit using a protocol-level vector. Telling users to simply “watch their health factor” during an infinite loop protocol exploit, in my opinion, deflects from the protocol-level failure causing the health factor to deteriorate.\u003c/p\u003e\n\u003cp\u003eFurthermore, the execution timeline is highly concerning. The wallet involved slowly accumulated $THE for months to fly under the radar, and the exploit was executed exactly one day before $THE was scheduled to be delisted from the Core market. The community even flagged the suspicious whale activity beforehand.\u003c/p\u003e\n\u003cp\u003eMaking the liquidated $THE borrowers whole would be a relatively minor cost for the protocol’s treasury, but it would be a massive show of integrity and build incredible goodwill with the community. I truly hope Venus chooses to support its users on this.\u003c/p\u003e","post_number":4,"post_type":1,"updated_at":"2026-03-18T17:50:42.483Z","reply_count":0,"reply_to_post_number":null,"quote_count":0,"incoming_link_count":1,"reads":17,"readers_count":16,"score":23.4,"yours":false,"topic_id":5712,"topic_slug":"the-market-incident-post-mortem","display_username":"DArk Gon","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"bookmarked":false,"actions_summary":[{"id":2,"count":1}],"moderator":false,"admin":false,"staff":false,"user_id":2450,"hidden":false,"trust_level":0,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false}],"stream":[12941,12944,12948]},"timeline_lookup":[[1,225],[2,224]],"suggested_topics":[{"id":5667,"title":"[BNB Chain] Adjust Prime Rewards Allocation for Feb-2026","fancy_title":"[BNB Chain] Adjust Prime Rewards Allocation for Feb-2026","slug":"bnb-chain-adjust-prime-rewards-allocation-for-feb-2026","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-02-05T07:37:18.848Z","last_posted_at":"2026-02-05T07:37:18.898Z","bumped":true,"bumped_at":"2026-02-05T07:37:18.898Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags_descriptions":{},"like_count":2,"views":3704,"category_id":7,"featured_link":null,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user":{"id":1920,"username":"devitavenus","name":"Devita","avatar_template":"/letter_avatar_proxy/v4/letter/d/f07891/{size}.png","admin":true,"moderator":true,"trust_level":4}}]},{"id":5820,"title":"Public Disclosure of Guardian Multisig Signers : A Due Diligence Concern for Depositors","fancy_title":"Public Disclosure of Guardian Multisig Signers : A Due Diligence Concern for Depositors","slug":"public-disclosure-of-guardian-multisig-signers-a-due-diligence-concern-for-depositors","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-06-09T06:35:08.279Z","last_posted_at":"2026-06-09T06:35:08.343Z","bumped":true,"bumped_at":"2026-06-09T06:35:08.343Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags_descriptions":{},"like_count":0,"views":3622,"category_id":7,"featured_link":null,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user":{"id":2488,"username":"Bullish","name":"","avatar_template":"/letter_avatar_proxy/v4/letter/b/779978/{size}.png","trust_level":0}}]},{"id":5621,"title":"Recovery and Restoration of User Funds from Venus Pools via Rake Farm","fancy_title":"Recovery and Restoration of User Funds from Venus Pools via Rake Farm","slug":"recovery-and-restoration-of-user-funds-from-venus-pools-via-rake-farm","posts_count":2,"reply_count":0,"highest_post_number":2,"image_url":null,"created_at":"2025-12-30T01:12:06.139Z","last_posted_at":"2025-12-30T10:05:37.256Z","bumped":true,"bumped_at":"2025-12-30T10:05:37.256Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags_descriptions":{},"like_count":0,"views":3100,"category_id":7,"featured_link":null,"posters":[{"extras":null,"description":"Original Poster","user":{"id":2410,"username":"Ctstar","name":null,"avatar_template":"/letter_avatar_proxy/v4/letter/c/d78d45/{size}.png","trust_level":0}},{"extras":"latest","description":"Most Recent Poster","user":{"id":1920,"username":"devitavenus","name":"Devita","avatar_template":"/letter_avatar_proxy/v4/letter/d/f07891/{size}.png","admin":true,"moderator":true,"trust_level":4}}]},{"id":5640,"title":"Proposal: Allez Labs Risk Management","fancy_title":"Proposal: Allez Labs Risk Management","slug":"proposal-allez-labs-risk-management","posts_count":5,"reply_count":0,"highest_post_number":5,"image_url":"https://community.venus.io/uploads/default/optimized/2X/6/67f936a905dec976ee28952f2b3c360c29a77830_2_1024x409.jpeg","created_at":"2026-01-16T13:23:58.466Z","last_posted_at":"2026-01-19T02:17:27.844Z","bumped":true,"bumped_at":"2026-01-19T02:17:27.844Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags_descriptions":{},"like_count":12,"views":3751,"category_id":7,"featured_link":null,"posters":[{"extras":null,"description":"Original Poster","user":{"id":2420,"username":"AllezLabs","name":"Allez Labs","avatar_template":"/user_avatar/community.venus.io/allezlabs/{size}/3325_2.png","trust_level":3}},{"extras":null,"description":"Frequent Poster","user":{"id":2027,"username":"Omar.bnb","name":null,"avatar_template":"/letter_avatar_proxy/v4/letter/o/f17d59/{size}.png","trust_level":2}},{"extras":null,"description":"Frequent Poster","user":{"id":1327,"username":"ChristoWarriorCrypto","name":"Christopher Red Star México 🇲🇽","avatar_template":"/user_avatar/community.venus.io/christowarriorcrypto/{size}/2424_2.png","trust_level":4}},{"extras":null,"description":"Frequent Poster","user":{"id":2419,"username":"Serhat72","name":"Serhat","avatar_template":"/letter_avatar_proxy/v4/letter/s/73ab20/{size}.png","trust_level":2}},{"extras":"latest","description":"Most Recent Poster","user":{"id":1472,"username":"kang","name":"kang","avatar_template":"/letter_avatar_proxy/v4/letter/k/d6d6ee/{size}.png","trust_level":2}}]},{"id":5879,"title":"[BNB Chain] Venus Treasury Cleanup — Phase 2","fancy_title":"[BNB Chain] Venus Treasury Cleanup — Phase 2","slug":"bnb-chain-venus-treasury-cleanup-phase-2","posts_count":1,"reply_count":0,"highest_post_number":1,"image_url":null,"created_at":"2026-07-30T10:03:06.835Z","last_posted_at":"2026-07-30T10:03:06.887Z","bumped":true,"bumped_at":"2026-07-30T10:03:06.887Z","archetype":"regular","unseen":false,"pinned":false,"unpinned":null,"visible":true,"closed":false,"archived":false,"bookmarked":null,"liked":null,"tags_descriptions":{},"like_count":1,"views":3125,"category_id":13,"featured_link":null,"posters":[{"extras":"latest single","description":"Original Poster, Most Recent Poster","user":{"id":1920,"username":"devitavenus","name":"Devita","avatar_template":"/letter_avatar_proxy/v4/letter/d/f07891/{size}.png","admin":true,"moderator":true,"trust_level":4}}]}],"tags_descriptions":{},"id":5712,"title":"THE Market Incident Post-Mortem","fancy_title":"THE Market Incident Post-Mortem","posts_count":3,"created_at":"2026-03-17T10:32:21.596Z","views":10960,"reply_count":1,"like_count":6,"last_posted_at":"2026-03-18T17:50:42.483Z","visible":true,"closed":false,"archived":false,"has_summary":false,"archetype":"regular","slug":"the-market-incident-post-mortem","category_id":7,"word_count":2238,"deleted_at":null,"user_id":2420,"featured_link":null,"pinned_globally":false,"pinned_at":null,"pinned_until":null,"image_url":"https://community.venus.io/uploads/default/optimized/2X/e/e1e916f3a8c07feb022645a9f651e61da3e89a69_2_1024x334.jpeg","slow_mode_seconds":0,"draft":null,"draft_key":"topic_5712","draft_sequence":null,"unpinned":null,"pinned":false,"current_post_number":1,"highest_post_number":4,"deleted_by":null,"actions_summary":[{"id":7,"count":0,"hidden":false,"can_act":false},{"id":4,"count":0,"hidden":false,"can_act":false},{"id":8,"count":0,"hidden":false,"can_act":false},{"id":10,"count":0,"hidden":false,"can_act":false}],"chunk_size":20,"bookmarked":false,"bookmarks":[],"topic_timer":null,"message_bus_last_id":0,"participant_count":3,"show_read_indicator":false,"thumbnails":[{"max_width":null,"max_height":null,"width":1920,"height":628,"url":"https://community.venus.io/uploads/default/original/2X/e/e1e916f3a8c07feb022645a9f651e61da3e89a69.jpeg"},{"max_width":1024,"max_height":1024,"width":1024,"height":334,"url":"https://community.venus.io/uploads/default/optimized/2X/e/e1e916f3a8c07feb022645a9f651e61da3e89a69_2_1024x334.jpeg"}],"slow_mode_enabled_until":null,"summarizable":false,"details":{"can_edit":false,"notification_level":1,"participants":[{"id":2420,"username":"AllezLabs","name":"Allez Labs","avatar_template":"/user_avatar/community.venus.io/allezlabs/{size}/3325_2.png","post_count":1,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"trust_level":3},{"id":2449,"username":"Remember","name":"Remember_the_name","avatar_template":"/letter_avatar_proxy/v4/letter/r/ecccb3/{size}.png","post_count":1,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"trust_level":0},{"id":2450,"username":"DarkVirgin","name":"DArk Gon","avatar_template":"/letter_avatar_proxy/v4/letter/d/eb9ed0/{size}.png","post_count":1,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"trust_level":0}],"created_by":{"id":2420,"username":"AllezLabs","name":"Allez Labs","avatar_template":"/user_avatar/community.venus.io/allezlabs/{size}/3325_2.png"},"last_poster":{"id":2450,"username":"DarkVirgin","name":"DArk Gon","avatar_template":"/letter_avatar_proxy/v4/letter/d/eb9ed0/{size}.png"},"links":[{"url":"https://debank.com/profile/0x1a35bd28efd46cfc46c2136f878777d69ae16231","title":"DeBank | Your go-to portfolio tracker for Ethereum and EVM","internal":false,"attachment":false,"reflection":false,"clicks":25,"user_id":2420,"domain":"debank.com","root_domain":"debank.com"},{"url":"https://app.blocksec.com/phalcon/explorer/tx/bsc/0x4f477e941c12bbf32a58dc12db7bb0cb4d31d41ff25b2457e6af3c15d7f5663f","title":null,"internal":false,"attachment":false,"reflection":false,"clicks":21,"user_id":2420,"domain":"app.blocksec.com","root_domain":"blocksec.com"},{"url":"https://debank.com/profile/0x737bc98f1d34e19539c074b8ad1169d5d45da619","title":"DeBank | Your go-to portfolio tracker for Ethereum and EVM","internal":false,"attachment":false,"reflection":false,"clicks":20,"user_id":2420,"domain":"debank.com","root_domain":"debank.com"},{"url":"https://x.com/VenusProtocol","title":null,"internal":false,"attachment":false,"reflection":false,"clicks":10,"user_id":2420,"domain":"x.com","root_domain":"x.com"},{"url":"https://etherscan.io/tx/0xae5bcff7769a31a0adce95963ac4284dd1b593ccf344be14a3a84d9a8d3769ea","title":null,"internal":false,"attachment":false,"reflection":false,"clicks":10,"user_id":2420,"domain":"etherscan.io","root_domain":"etherscan.io"},{"url":"https://code4rena.com/reports/2023-05-venus","title":"Code4rena | Keeping high severity bugs out of production","internal":false,"attachment":false,"reflection":false,"clicks":9,"user_id":2420,"domain":"code4rena.com","root_domain":"code4rena.com"},{"url":"https://etherscan.io/tx/0x3824e4dda3281fa48d018eb3e388a0bdf608a7d59bcfb8cef82f397b052a2cdf","title":null,"internal":false,"attachment":false,"reflection":false,"clicks":5,"user_id":2420,"domain":"etherscan.io","root_domain":"etherscan.io"},{"url":"https://bscscan.com/tx/0x2925520db5e5d1a2854fdd56b068299309c92940ce6b185b37493ecd2e4ab230","title":null,"internal":false,"attachment":false,"reflection":false,"clicks":3,"user_id":2420,"domain":"bscscan.com","root_domain":"bscscan.com"},{"url":"https://bscscan.com/tx/0x4253a8984929fd932cebd2d99c02c3b4e8304154db239aeae0f1bcf094eca296","title":null,"internal":false,"attachment":false,"reflection":false,"clicks":3,"user_id":2420,"domain":"bscscan.com","root_domain":"bscscan.com"},{"url":"https://x.com/AllezLabs","title":null,"internal":false,"attachment":false,"reflection":false,"clicks":2,"user_id":2420,"domain":"x.com","root_domain":"x.com"},{"url":"https://community.venus.io/t/multi-chain-patch-fix-for-the-market-donation-attack/5718","title":"[Multi-chain] Patch Fix for THE Market Donation Attack","internal":true,"attachment":false,"reflection":true,"clicks":1,"user_id":2306,"domain":"community.venus.io","root_domain":"venus.io"},{"url":"https://community.venus.io/t/bnb-chain-the-market-bad-debt-repayment/5719","title":"[BNB Chain] THE Market Bad Debt Repayment","internal":true,"attachment":false,"reflection":true,"clicks":1,"user_id":2306,"domain":"community.venus.io","root_domain":"venus.io"}]}}