Exploit Inertia: a two-year-old ERC-4626 flaw strikes DeFi again

A lending protocol on Ethereum, Inertia Finance, suffered a major exploit that exploited a known vulnerability in the ERC-4626 standard, a widely used DeFi norm for managing tokenized assets. The attack allowed attackers to manipulate the collateral prices of roETH before draining funds from five lending markets, highlighting that vulnerabilities in smart contracts can persist for years after discovery. This incident underscores the systemic risks associated with the use of outdated or poorly implemented standards, despite their widespread adoption. What Happened The attackers exploited a weakness in Inertia Finance’s implementation of ERC-4626, enabling them to undervalue collateral assets before withdrawing funds exceeding their actual value. Five lending markets were targeted, resulting in the drainage of several million dollars. While the exact amount of lost funds has not been officially disclosed by Inertia, unofficial estimates suggest a range between 5 and 10 million dollars. The protocol immediately suspended operations and launched an investigation with specialized cybersecurity firms. No compensation has yet been announced for victims, but discussions are underway with DeFi insurers. Why This Exploit Is Significant The ERC-4626 vulnerability, identified as early as 2023, had already been exploited in other protocols like Yearn Finance or Rari Capital. Yet, this standard remains widely used in the DeFi ecosystem, particularly for tokens like yTokens or stETH. Attackers took advantage of poor price verification in deposit and withdrawal functions—a well-documented but often underestimated risk. This incident caused a 15% drop in Inertia’s native token (if applicable) and reduced liquidity in Ethereum lending markets. More broadly, it could lead to higher insurance premiums for ERC-4626-using protocols, increasing their operational costs. Systemic risks are compounded by a lack of transparency: Inertia has not disclosed the exact amount of drained funds, complicating risk assessment for investors. The DeFi community now advocates for systematic audits of ERC-4626 protocols, a standard considered mature. Other protocols could be targeted in the coming weeks if attackers identify similar vulnerabilities in other implementations. What to Watch For The publication of an independent audit report by Inertia, which may reveal the full extent of the exploit and the corrective measures taken. The response from DeFi insurers: a rise in insurance premiums or withdrawal of coverage for ERC-4626 protocols would be a warning signal for the sector. The price movements of assets linked to Inertia and similar protocols, which may face selling pressure if investors panic. Potential regulatory reactions, as regulators may intensify scrutiny of DeFi due to these systemic risks. Audits of ERC-4626-using protocols, particularly Morpho, Aave, or Compound, to identify potential similar vulnerabilities.