USM, the minimalist Ethereum-based stablecoin protocol, has suffered a smart contract exploit that resulted in an estimated loss of 70.83 ETH, worth approximately $136,000 at the time of the incident. Blockchain security firm SlowMist identified a pricing logic flaw inside USM’s defund() redemption mechanism as the core vulnerability, rather than the flash loan itself being the underlying security failure.
The affected contract is USM’s deployed Ethereum contract at 0x2a7fff44c19f39468064ab5e5c304de01d591675, which includes the protocol’s fund(), defund() and ethFromDefund() functions. The attacker used temporary flash-loan liquidity to amplify an inconsistency in how the protocol calculated ETH returned when FUM tokens were redeemed.
Split Redemptions Produced More ETH
SlowMist traced the problem to ethFromDefund(), which calculates redemption value using an arithmetic mean between the current FUM selling price and an estimated price after the transaction. The formula lacked what the security firm described as “split invariance,” meaning equivalent economic actions could produce different results depending on how they were divided. Redeeming the same amount of FUM through 64 smaller transactions returned more ETH than performing one equivalent large redemption.
The discrepancy was compounded by USM’s per-redemption adjShrinkFactor state adjustment and integer rounding. SlowMist said the attacker first used a flash loan and called fund() to influence the protocol’s internal pricing conditions before repeatedly executing smaller defund() transactions. This sequence allowed the attacker to extract excess ETH from USM while eventually repaying the temporary borrowed capital.
Flash loans themselves are not inherently exploits. OWASP’s Smart Contract Top 10 describes them as uncollateralized borrowing completed within a single transaction and notes that they become dangerous when large temporary balances can amplify an existing weakness in pricing, accounting or other protocol logic. In USM’s case, the flash loan served as an amplifier for flawed redemption mathematics rather than creating the vulnerability on its own.
Recovery Status Remains Unclear
SlowMist identified separate addresses for the attacker-controlled account, exploit contract and profit recipient, providing an on-chain trail for investigators. However, no confirmed recovery of the approximately 70.83 ETH loss or comprehensive reimbursement plan had been disclosed at the time of the security analysis.
The incident illustrates a less obvious category of DeFi risk in which individually valid contract calls can become exploitable when repeated under carefully engineered conditions. USM’s redemption functions were designed around exchanges between ETH, USM and its associated FUM funding token, but the exploit exposed an economic inconsistency in that process. The critical failure was therefore not unauthorized access to a protected function, but pricing behavior that changed depending on how a redemption was fragmented.