Skip to main content
• 5 min read

Edel Finance Exploit: $403K Bad
Debt via wGOOGLx Exchange-Rate Manipulation

Edel Finance incurred ~$403K in bad debt after a flash-loan-assisted wGOOGLx exchange-rate manipulation inflated tokenized Google stock collateral by 78x.

AUTOSEC.DEVAUTOSEC.DEV
Edel Finance Exploit: $403K Bad Debt via wGOOGLx Exchange-Rate Manipulation
  • Incident Date: July 1, 2026
  • Target: Edel Finance
  • Target Overview: Edel Finance operates a lending market for tokenized equities and other real-world assets. The incident affected its Ethereum-based Edel Lending V1 deployment and the pricing path for wrapped xStock collateral.
  • Total Loss: Approximately $403,000 in bad debt
  • Reported Attacker Address: 0x58428161bB55c14A413945f06cbDeC157F411C76
  • Reported Victim Contract: 0x3eeeb3cd20f844a578807fc457388ceb9a67faa6
  • Exploit Transaction: 0xe2320086b2815d21b0927839bd0e306466c29a68d38d5361e99dd21ec5472612
  • Attack Vector: Oracle manipulation / ERC-4626 exchange-rate manipulation / flash-loan-assisted exploitation

Incident Review & Technical Details​

1. Attack Path​

  1. The attacker sourced temporary capital through a flash loan: Defimon reported that the attacker flash-loaned approximately 180,000 USDC and used newly deployed contracts to execute the exploit in one Ethereum transaction.
  2. A repeated supply-and-borrow loop distorted the wrapper exchange rate: GoPlus Security and Defimon reported that the attacker repeatedly supplied and borrowed assets, with Defimon identifying a 41-cycle loop. The loop altered the relationship between wGOOGLx shares and the wrapper's underlying GOOGLx balance.
  3. The collateral oracle trusted a manipulable share-to-asset conversion: Edel Lending valued wGOOGLx using its wrapped xStock exchange rate. Defimon described this as an ERC-4626-style convertToAssets dependency derived from the wrapper's underlying balance and total supply. The attacker manipulated that conversion so the lending market valued wGOOGLx collateral at approximately 78x its intended value.
  4. Correct external market data could not prevent the mispricing: Edel Finance stated that its Chainlink feed continued to report Alphabet's underlying share price correctly. The failure occurred after that feed, when the protocol converted between GOOGLx and wGOOGLx; the composed collateral price therefore became unsafe even though the base market price remained accurate.
  5. Inflated collateral unlocked real borrowing capacity: Against the overstated wGOOGLx position, the attacker borrowed USDC and wrapped tokenized equities, including wSPYx, wQQQx, wMSTRx, wNVDAx, and wTSLAx. The resulting position left Edel Finance with approximately $403,000 in bad debt. GoPlus separately estimated the attacker's net profit after repaying the flash loan at approximately $305,000.

2. Impact Scope​

  • Protocol-Level Loss: Edel Finance reported approximately $403,000 in bad debt from Edel Lending V1.
  • Affected Network and Component: The exploit affected the Ethereum V1 lending deployment and its wGOOGLx collateral-pricing path.
  • Affected Assets: The attacker borrowed USDC plus wrapped tokenized exposures to the S&P 500, Nasdaq-100, Strategy, Nvidia, and Tesla.
  • Depositor Impact: Edel Finance said it would absorb the bad debt and restore affected depositor balances 1:1, so the reported protocol loss is not expected to be passed through to depositors.
  • Protocol Availability: All V1 contracts were paused after detection and remained offline at the time of the reviewed statements. Edel advised users not to interact with V1.
  • Ecosystem Significance: The incident demonstrates a composability failure in tokenized-equity lending: a reliable base price feed does not make a collateral price safe when a manipulable wrapper conversion is multiplied into the final valuation.

3. Official Statements​

  • Edel Finance: The team said it identified and contained the exploit, paused all V1 contracts, preserved protocol records, and would absorb the approximately $403,000 bad debt. It also announced a V2 deployment with redesigned pricing architecture, a 1:1 balance-restoration plan, and a formal white-hat settlement offer.
  • Blockaid: Blockaid reported detecting the exploit while it was in progress and attributed the drain to a flash-loan-assisted manipulation of the wGOOGLx/GOOGLx exchange rate using newly deployed exploit contracts.
  • GoPlus Security: GoPlus described repeated supply and borrow operations that inflated wGOOGLx collateral value, enabling the attacker to borrow USDC and multiple wrapped xStock assets before repaying the flash loan.

4. Investigation Progress​

The attacker's address and exploit transaction have been publicly identified. Etherscan records show subsequent deposits from the reported attacker address into Tornado Cash, reducing the visibility of the downstream fund trail. Edel Finance said it was coordinating with exchanges and ecosystem partners while offering the attacker a defined white-hat settlement window; no confirmed fund return was identified in the reviewed sources at the time of writing.

The root-cause review should treat the wrapper and lending market as one pricing system:

  • Reproduce the 41-cycle supply-and-borrow sequence on an Ethereum fork and convert it into a regression test.
  • Ensure collateral valuation cannot rely on a spot ERC-4626 share-to-asset rate that can be changed materially inside one transaction.
  • Add exchange-rate deviation bounds, time-weighted observations, minimum-liquidity assumptions, debt ceilings, and emergency circuit breakers for wrapped real-world assets.
  • Test the complete pricing composition—base Chainlink feed, wrapper conversion, collateral factor, and borrowing limits—under flash-loan-funded balance and total-supply changes.
  • Publish the final technical post-mortem, V2 pricing invariant, affected-balance methodology, restoration timeline, and settlement outcome.

AUTOSEC.DEV Solution​

Preventing a repeat requires controls around both the wrapper's share accounting and the lending market's collateral-onboarding process.

  1. Secure Code Review - Edel Lending's base Chainlink price remained correct, but the final wGOOGLx valuation inherited a manipulable share-to-asset conversion. AUTOSEC.DEV reviews oracle composition, ERC-4626 accounting, donation and balance-manipulation paths, and lending invariants to identify cases where a safe base feed becomes unsafe after wrapper math is applied.
  2. Security Strategy & Planning - Tokenized equities introduce issuer, wrapper, market-hours, liquidity, and oracle dependencies that ordinary crypto collateral does not. For markets like Edel Finance, we define collateral-onboarding standards with deviation limits, debt ceilings, liquidity thresholds, circuit breakers, and incident playbooks tailored to wrapped real-world assets.
  3. Penetration Testing - The reported attack used a flash loan and a 41-cycle supply-and-borrow loop to create borrowing power from transient state. We reproduce these workflows on forks and test whether wrapper exchange rates, health factors, and borrow limits remain bounded throughout a single adversarial transaction.

Reference​