Visor Finance: Vulnerable require() in vVISR deposit() — self-referential ownership bypass → unlimited share minting
Visor Finance lost $8.2M in VISR when an attacker bypassed the vVISR deposit() check by deploying a contract that owned itself, minting 195K vVISR tokens redeemable for 8.8M underlying VISR — though the dump crashed the token 87%, limiting actual ETH extraction to ~$450K.
Summary #
Visor Finance suffered a Liquidity Management / Yield (Uniswap V3 LP manager) on 2021-12-22, resulting in a loss of approximately $8M.
What happened #
Visor Finance lost $8.2M in VISR when an attacker bypassed the vVISR deposit() check by deploying a contract that owned itself, minting 195K vVISR tokens redeemable for 8.8M underlying VISR — though the dump crashed the token 87%, limiting actual ETH extraction to ~$450K.
Linked factors #
- RD-F-004 — causal : Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code]
- RD-F-007 — related : Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
- RD-F-090 — illustrative : Mixer withdrawal → protocol interaction [via realtime_signals/Pre-exploit on-chain signals: Tornado Cash funding of attacker address minutes before; custom contract deployment]