On October 28, a Tranche Vault related to Valinor Digital and involving Fence Finance on the Avalanche chain was breached. The security firm Blockaid detected unusual behavior that day: the attacker initiated a flash loan, rapidly minting inflated tranche shares in quantity or price, and then redeemed the remaining USDC assets in the vault according to the rules. Utilizing this "inflate shares first, then empty the vault" on-chain path, the attacker transferred approximately $1.01 million worth of USDC from the Tranche Vault within just two transactions. Even more concerning is that Blockaid did not classify it as a completed isolated incident, but rather marked the event as an ongoing attack, indicating that at the time of their alert, the Tranche Vault and related parties were still facing unclear security risks.

Flash Loan Inflates Shares, Vault is Instantly Emptied

During the period when Blockaid marked it as a "continuous attack," two closely spaced on-chain transactions outlined the complete execution path. The attacker first initiated a flash loan on Avalanche, instantly borrowing a large amount of funds and injecting USDC into the Tranche Vault related to Valinor Digital to mint tranche shares. Due to exploitable spaces in the contract's share minting rules, this liquidity injected in a short time was magnified into tranche shares that were inflated in quantity and overvalued, making it appear as if the attacker had "created" holdings exceeding normal ranges in mere seconds.

After the shares were successfully inflated, the attack chain moved to the second step: the attacker immediately invoked the redemption logic, using these inflated tranche shares as proof to withdraw the remaining USDC assets from the same vault. The flash loan was repaid within the transaction, while approximately $1.01 million worth of USDC was drained from the Tranche Vault into the attacker's hands. The entire process relied almost completely on the rules design of the Tranche Vault regarding "how shares are minted and how assets are redeemed based on shares." Once this set of rules allowed flash loans to create inflated shares in a very short time, the actual assets in the vault would be mechanically executed on-chain, passively flowing to the attacker's account.

Why Tranche Yield Vault Became a Weak Point

The core of the layered yield vault lies in splitting the same pool of assets into several "shares" with different risks and returns, using a pricing formula to map the deposited USDC and other assets into corresponding tranche shares, and determining how much asset can be reclaimed during redemptions based on the number of shares and unit price. For such products, the minting and redemption prices of shares are not arbitrary figures but are recalculated results based on the changes in vault assets, historical yields, unrealized gains and losses, etc. The fairness and security of the entire yield distribution rely on these intricate rules of "how shares are minted and redeemed."

The issue arises when this set of rules lacks protection against "short-term funding" and "extreme conditions" by design, leaving room for flash loan attacks. This vault associated with Tranche design on Avalanche was described as a "type of attack where share minting and redemption logic are abused": the attacker leveraged a flash loan to amplify available funds within a single block, exploiting vulnerabilities to mint shares in inflated quantity or value at an extremely favorable price, while the vault's redemption logic mechanically distributed assets according to the number of shares, failing to recognize that this batch of shares did not correspond to actual long-term positions, ultimately redeeming the remaining USDC in the Vault in full for the attacker. This reveals not just a defect in a single contract's implementation, but also that layered yield DeFi products, whenever there are "gaps" in their share minting, pricing, and redemption rules that lack constraints against extreme funding behaviors, can escalate into a systemic risk in attack environments similar to those amplified by flash loans.

Attack Marked as Ongoing, Risk Boundaries Unclear

In the theft incident of the Tranche Vault on Avalanche, a striking note is that the security firm Blockaid, upon detecting anomalies on October 28, did not classify it as an "ended incident," but clearly marked it as an "ongoing attack." This indicates that at the point of their alert, the related attack path had not been completely confirmed as blocked, even though the known two flash loan utilization transactions had already drained about $1.01 million worth of USDC from the Vault, and whether there is still potential for subsequent operations on-chain remains an open question.

Even more challenging is that the current publicly available materials lack key information, making it difficult for outsiders to draw a clear risk boundary: the specific address of the attacker and transaction hashes have not been systematically disclosed, it is unclear whether the contract has been paused after the incident, whether patches have been deployed, and whether the project has initiated any remediation or compensation mechanisms, all of which have not been systematically announced to the public. Multiple media outlets have reached a roughly consistent statement about the "approximately $1.01 million loss," but none have confirmed that this is the final capped loss size. Under the premise that these core variables have not yet been resolved, any assessment of responsibility attribution or speculation about subsequent remediation paths can only remain in a state of cautious observation.

How Avalanche DeFi Users Can Protect Themselves

From the perspective of the average Avalanche DeFi user, this theft of the Tranche Vault feels more like a lesson in "understanding complex yield rules." Structured yield vaults inherently rely on precise designs of share minting, pricing, and redemption rules, and this attack effectively exploited a flash loan to "inflate" tranche shares within a very short timeframe before draining USDC from the vault. For users, whenever encountering products with multi-level compartments and different priority yield distributions, it is important to recognize that the rules themselves are part of the risk landscape; it is not only necessary to look at the yield rate but also to check whether there are publicly available share rule explanations, whether there have been third-party security audits, and whether these rules could potentially be circumvented in extreme situations.

In this incident, the security firm Blockaid detected in real-time on October 28 that the Tranche Vault related to Valinor Digital on Avalanche was under attack and marked it as an ongoing event that day, indicating that for users, paying attention to the alerts from security firms and whether the project team has released announcements regarding contract pauses or risk control is not an "additional action," but rather an essential habit for participating in structured products. Current available information has not provided a clear remediation or compensation plan, and whether similar event risks can be mitigated in the future largely depends on whether the protocol will reassess the minting and redemption logic of tranche shares, such as whether to add more constraints, caps, or risk control trigger conditions; users should view these rule adjustments as important indicators to observe, rather than just focusing on superficial changes in yield.

Join our community to discuss together and become stronger!
AiCoin Exclusive Hyperliquid Benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin Exclusive Aster Benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram Community: https://t.me/AiCoinWhaleData
On-chain Community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin On-chain Twitter: https://x.com/aicoinwhaledata

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。