Fence Finance Tranche Vault Share Inflation

On October 27, 2026, Fence Finance lost approximately $1.01 million when a flash-loan attacker manipulated the share accounting of a Tranche Vault on Avalanche, minting an inflated number of vault shares and redeeming them for the pool's entire USDC balance.

What happened

The target was a Tranche Vault on Avalanche C-Chain that Web3 security firm Blockaid linked to Fence Finance and Valinor Digital, though neither company confirmed which of them operated the contract. The vault accepted USDC deposits and issued shares representing a claim on the pool.

The flaw sat in the vault's share-minting logic, which miscalculated the value of a deposit and so let an attacker mint far more shares than the USDC actually paid in justified. Using a flash loan to supply the working capital, the attacker drove the vault's share count up, then redeemed those inflated shares against the real underlying balance. On-chain records show the vault (0xE25CB545Bdd47a8Ec2d08001cb5661B00D47621a) transferring 1,013,353.61 USDC to the attacker's contract at roughly 8:00 p.m. ET, leaving the identified contract with no USDC. Blockaid published its alert about an hour later, at 9:07 p.m. ET on October 27, and described the exploit as still ongoing at the time.

Aftermath

As of the initial disclosures, none of the funds had been reported recovered or frozen, and no attacker identity had been established. Reports disagreed on whether the exploit was fully over or whether the vault had been paused and the flaw patched. Neither Fence Finance nor Valinor Digital had issued a public statement, and no official post-mortem had been published.

Why it matters

This is another entry in the long line of ERC-4626-style vault share-accounting failures, where the arithmetic that converts deposits into shares can be bent so that a share is worth more than the assets backing it. A flash loan turns that arithmetic gap into an instant drain: it supplies the capital to inflate the share count and is repaid in the same transaction, so the attacker needs no stake of their own. The same pattern emptied Resupply, where a $4,000 flash loan exploited an ERC-4626 donation attack on a two-hour-old vault for $9.8M, and Sonne Finance, a classic donation attack on a freshly deployed market. As with Abracadabra Money, the defensive answer is well-known — seed vaults with virtual shares or a dead-shares offset and round every share calculation in the protocol's favour — yet newly launched vaults keep shipping without it.