Harry

DeFi || Risk ||
Prev. @anthiasxyz

[Harry @0xhark017]

0/ Introducing HyperARK (hARK), new home for yield on HyperEVM.

Visit now: https://t.co/6f7QcfXRhQ
Join Community: https://t.co/9mFzFQFujF

Starting today with seamless access to Morpho Blue markets. More products and opportunities coming soon.
Let’s break it down 👇

[Harry @0xhark017]

@HyperliquidX @hyperlendx @HyperFlash_hl @hyperbeat @HyperionDeFi @felixprotocol @gauntlet_xyz @hyperithm @MEVCapital @Morpho

[Harry @0xhark017]

0/ Introducing HyperARK (hARK), new home for yield on HyperEVM.

Visit now: https://t.co/6f7QcfXRhQ
Join Community: https://t.co/9mFzFQFujF

Starting today with seamless access to Morpho Blue markets. More products and opportunities coming soon.
Let’s break it down 👇

[Harry @0xhark017]

6/ Join the community today for further updates and early access to the coming products.

https://t.co/9mFzFQFujF

[USD.AI @USDai_Official]

https://t.co/aJLLc8QA5i

[Harry @0xhark017]

Great work by @0xkooone, check the https://t.co/QuZP5nX3kB to track the exposure across all the vaults across the protocols.

[kooone @0xkooone]

0/ Introducing: https://t.co/sr48jSZOrS

One screen to answer three questions:
– Which curator got hit?
– Which protocol lost how much?
– Is my vault actually safe?

Beta is coming soon, starting with Resolv-focused coverage.

https://t.co/1FPFe5V1cQ

[Harry @0xhark017]

@gauntlet_xyz

[D2 Finance @D2_Finance]

🚨 @ResolvLabs USR just got exploited: here's the full on-chain breakdown

h/t @yieldsandmore who flagged this first | data via @ArkhamIntel

An attacker deposited 100K USDC into Resolv's USR Counter contract via requestSwap and received 49,950,000 USR back (~$39M)

That's a 500× overcredit on a $100K deposit. The minting function is broken.

On-chain receipts:

→ 100,000 USDC sent to Resolv: USR Counter (0xa27a...5861)
→ 50,000,000 USR minted from null address to Counter
→ 49,950,000 USR forwarded to attacker (0x04A288a7...caEd)
→ 100,000 USDC sent to intermediary (0xacB7027f...2b8e)

The _targetAmount in the input data reads:
50,000,000,000,000,000,000,000,000 (50M × 10^18)

The requestSwap → completeSwap is a 2-step async process.

Either the oracle was gamed, the off-chain signer was compromised, or the amount validation between request and completion is simply missing.

The attacker's exit playbook is textbook DeFi hack cashout running at full speed:

Step 1 — Wrap USR → wstUSR to access deeper DEX liquidity

20M USR → 17.65M wstUSR
15M USR → 13.24M wstUSR

Step 2 — Dump wstUSR across every available venue

8.77M wstUSR → 9.7M USDT (KyberSwap)
2M wstUSR → 2.01M USDC (direct contract 0x04a2...caed)
1.31M wstUSR → 655K USDT (KyberSwap)
1.31M wstUSR → 148K USDT (KyberSwap — slippage getting brutal)
604K wstUSR → 568K USDT
300K wstUSR → 277K USDC (Velora)
300K wstUSR → 303K USDC (Velora)
Dozens of 100K-150K wstUSR clips through Velora at varying slippage

Step 3 — Convert stables → ETH aggressively

4.85M USDT → 2,297 ETH (contract 0xbeef...c555)
1.66M USDT → 789 ETH (Uniswap V4)
2.02M USDC → 948 ETH (MetaMask Swaps)
1.5M USDT → 703 ETH (MetaMask Swaps)
2M USDT → 938 ETH (MetaMask Swaps)
808K USDT → 384 ETH
760K USDT → 362 ETH
656K USDT → 312 ETH
370K USDT → 174 ETH

Yes @MetaMask Swaps for multi-million dollar legs 😅

wstUSR selling at $0.50-$0.88 on the dollar across different trades, with slippage worsening as liquidity drains. Multiple failed transactions visible on-chain showing the urgency.

Estimated total extraction: $25M+ and counting. The attacker is still actively dumping remaining wstUSR positions as of this post.

For context Resolv had ~$500M+ TVL, an @immunefi bug bounty of $500K, Fireblocks custody integration, and multiple audits including a Sherlock competition.

Audits ≠ security. Monitoring partnerships ≠ prevention.

The core question: how did a 100K USDC requestSwap get authorized as a 50M USR completeSwap?

Someone needs to explain what happened between those two steps.

@PeckShieldAlert @peckshield @SlowMist_Team @hypaboreal you may want to take a look 👀

[Harry @0xhark017]

@USDai_Official is the rising star of the new on-chain RWAs. It provides loans to the GPU operators, tokenising the GPUs via the CALIBER framework, providing the great opportunity to participants of the future.

Here is my report on https://t.co/KK26tC8iZO from risk's point of view.
Check it out, the risk assessment of USDai

https://t.co/g9rbHBNy3V

[Harry @0xhark017]

https://t.co/4rdJL0ZZfW

[Harry @0xhark017]

@jrdothoughts @SentoraHQ Dropped a note at [email protected] kindly check.

[Harry @0xhark017]

@PatoNguch Keep going btw

[Harry @0xhark017]

@PatoNguch I am at 239

[Harry @0xhark017]

RLP from @ResolvLabs : High-yield delta-neutral risk buffer for USR. Here is a risk assessment for RLP.

https://t.co/5wz4CN9cmk

[Harry @0xhark017]

@actlysis Ohh, I just checked I am 239 🫥

[Harry @0xhark017]

@SolidityScan Believe in quality work ser😝😝☃️☃️