Avalanche TranchePool Hack Drains $1.01M USDC via Flaw

Settlement bug on Avalanche has wiped out $1.01 million USDC from an institutional private credit vault, revealing ongoing vulnerabilities in tokenized credit infrastructure. A TranchePool of Valinor Digital, Oatfi, and Fence Finance suffered a loss of around 1.013 million USDC around the UTC day rollover. Per SlowMist, the pool posted scheduled principal as received for a new UTC day without confirmation of actual on-chain repayment. This erroneous indication was used to reactivate draw capacity before an attacker repeatedly invoked draw function 0x8e27c105 with the same calldata to carry out a double draw. The breach was initially reported on X. The flaw lies in the accounting logic of TranchePool, which collateralizes real-world debt into senior and junior tranches. Borrowers drew liquidity and repaid on schedule, using contracts that tracked availability.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to TronWeekly.