> ## Content Index
> Fetch the complete content index at: https://dexplain.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Aftermath of Value DeFi $6M Flash Loan Attack
- URL: https://dexplain.com/aftermath-of-value-defi-6m-flash-loan-attack/
- Published: 2020-11-16T20:03:00.000Z
- Updated: 2021-12-02T20:04:34.000Z
- Description: Aftermath of Value DeFi $6M Flash Loan Attack. Breakdown of Value Liquid exploit, and the team's proposed compensation plan via an IOU token.
- Author: wizardfromspace
- Tags: VALUE, defi, Ethereum, Blockchain, Smart Contracts

[Value DeFi](https://dexplain.com/tag/value-liquid) fell victim to a complex flash loan attack using [Aave](https://dexplain.com/aave-protocol-overtakes-maker-with-over-1-5-billion-locked/) and [Uniswap](https://dexplain.com/tag/uniswap) which drained their flagship MultiStables vault by $6 million. A starch reminder after the recent exploits of [Akropolis](https://dexplain.com/what-is-akropolis-a-look-at-defi-apps-sparta-and-delphi/) protocol and [Harvest Finance](https://dexplain.com/what-is-harvest-finance-defi-with-farm-tokenomics/) that DeFi product users need to remember this tech is highly experimental.

> The MultiStables vault was the subject of a complex attack that resulted in a net loss of $6M. [https://t.co/dnFRa5yPBJ](https://t.co/dnFRa5yPBJ?ref=dexplain.com)  
> We are currently working on a postmortem and are exploring ways to mitigate the impact on our users.
> 
> — Value DeFi (@value\_defi) [November 14, 2020](https://twitter.com/value%5Fdefi/status/1327660571592773632?ref%5Fsrc=twsrc%5Etfw&ref=dexplain.com)

To make matters worse for Value DeFi, the [MultiStables Vault](https://dexplain.com/yfv-finance-launches-value-vaults/) was flaunted to have these three innovative security features: “*1) Flash-loan attack prevention 2) Fake-token attack prevention 3) Re-entrance attack prevention.”*  The attacker may even have specifically targeted Value DeFi protocol off the back of their boast, as he signed a follow-up transaction with:

> do you really know flashloan?

## Double Flash Loan Attack

The hacker used a complex process involving a double flash loan. It started with a flash loan of around 80,000 ETH from Aave, and then a flash swap to secure $116 million DAI from Uniswap. At this point, the attacker swapped the [ETH](https://dexplain.com/tag/ethereum) for various [stablecoins](https://dexplain.com/tag/stablecoins) and deposited DAI into Value’s stablecoin vault.

> Giga arbitrage/exploit [https://t.co/iP8ivD8PRl](https://t.co/iP8ivD8PRl?ref=dexplain.com) [https://t.co/zP6nh0PUkS](https://t.co/zP6nh0PUkS?ref=dexplain.com) [pic.twitter.com/KMPX4LeM3U](https://t.co/KMPX4LeM3U?ref=dexplain.com)
> 
> — emiliano.eth 🦇 🔊 (@emilianobonassi) [November 14, 2020](https://twitter.com/emilianobonassi/status/1327646493256331264?ref%5Fsrc=twsrc%5Etfw&ref=dexplain.com)

Then the attack exploited the pricing [oracle](https://dexplain.com/tag/oracles) utilized by Value DeFi’s withdrawal method by completing a series of stablecoin swaps in [Curve](https://dexplain.com/tag/curve-finance). To summarize, the exploit let the attacker drain around $6.5 million worth of DAI from the multi vault pool before paying back the flash loans. You can see the full transaction here on [etherscan](https://etherscan.io/tx/0x46a03488247425f845e444b9c10b52ba3c14927c687d38287c0faddc7471150a?ref=dexplain.com).

## Value DeFi Compensation Plan

The team plans to create a compensation fund that will use a combination of developer and insurance funds. Along with a percentage of the fees generated by the protocol. However, the proposal is to create an [elastic](https://dexplain.com/what-is-based-money-the-defi-game-of-chicken/) supply IOU “*I owe you”* token. This would deploy at a 1:1 ratio for every dollar lost by the hack.

- The compensation fund will buy back IOU tokens to burn them until the lost funds have been paid back. Essentially, the team hopes this market pressure will keep the IOU token to hold a $1 peg.
- IOU token will automatically rebase every week to accrue interest, at the rate of 10% APY. This compensates affected farmers for their lack of access to capital.
- IOU tokens will be tradable, meaning affected depositors could *exit early* even at a profit if there is enough market demand.

Of course, the [VALUE](https://dexplain.com/value-defi-protocol-migrates-140m-liquidity-from-balancer/) token dipped since the attack with the price falling to a new low of $1.90 on Saturday, a drop of over 22% in 24 hours. However, since then the price is stabilizing at $2.05 though it was trading around $2.80 before the attack.

Due to its innovative nature [DeFi protocols](https://dexplain.com/tag/defi) continue to be vulnerable to ever-expanding attack vectors. Value DeFi states their team has no plans to give up despite the attack. And will come back stronger, with more security, while pushing their [roadmap](https://dexplain.com/value-liquid-will-feature-flexible-farming/) forward!