_discochuck_ (🔺doption arc )

A few hours ago, a USDC tranche vault on Avalanche lost ~$1M due to inconsistent principal accounting in the fund-user claim path. The vault has two roles: the fund provider, who deposits and withdraws principal, and the fund user, who borrows funds from the tranche and is responsible for repaying them. The attacker controlled both roles within the same tranche, allowing them to deposit funds as the provider and immediately borrow them as the user. The claim function deducted borrowed but unmatured principal from total deposits, but ignored matured yet unrepaid principal. When the attacker claimed again after maturity, the function first processed maturity records using the current timestamp, moving the previously borrowed principal into the matured balance, then checked the available amount. Because the calculation omitted the matured balance, it incorrectly restored the full borrowing allowance, even though nothing had been repaid. Flawed formula: Available = Total deposited − Borrowed, not yet matured Correct formula: Available = Total deposited − Borrowed, not yet matured − Matured, not yet repaid The fund-provider withdrawal function correctly deducts both balances, while the fund-user claim function omits matured but unrepaid principal. Key attack steps: 1. The attacker created a tranche with the same address as both fund provider and fund user, setting its maturity shortly afterward. 2. Using an Aave flash loan, the attacker deposited 1,013,353.61 USDC as the fund provider, then borrowed the entire principal as the fund user in the same transaction. They used those funds to repay the flash loan, paying a 506.68 USDC fee. 3. After 163 blocks, once maturity had passed, the attacker called claim again. The incorrectly restored allowance let them borrow another 1,013,353.61 USDC without repaying the first tranche loan or making a new deposit. The second borrowing was funded by other users’ principal deposits in the vault. Attack TX: app.blocksec.com/phalcon/exp…