Donation attack manipulates sDOLA price on Curve LlamaLend, triggering mass liquidation of crvUSD borrowers for ~$240K

A lending market on Curve’s LlamaLend that used sDOLA as collateral was hit by an oracle-manipulation “donation attack,” briefly inflating the on-chain sDOLA price and causing forced liquidations of crvUSD borrowers, from which the attacker extracted roughly $240,000. The incident did not stem from a core Curve or Inverse Finance contract bug, but from the way the sDOLA oracle and vault-style collateral were integrated into this specific LlamaLend market. On 2 March 2026, an attacker used flash loans and large swaps in the sDOLA/crvUSD LlamaLend market, combined with a permissionless DolaSavings “donation” into the sDOLA vault, to manipulate the oracle that valued sDOLA by about +13.8%. This temporary price spike pushed many sDOLA-backed positions below their safety thresholds, triggering “hard liquidations” of 27 active borrowers with around $10.9 million in collateral, while lenders in the market remained whole and sDOLA holders actually benefitted from the inflated valuation. Post‑attack analysis by Curve and external researchers estimates the attacker’s net profit at about $240,000 from cheaply liquidating crvUSD debt positions and capturing their collateral. Curve Finance has stated that the issue arose from the price oracle design for sDOLA and from the presence of sDOLA in the market that was not eligible as collateral, making the oracle sensitive to these donation-style manipulations rather than a direct bug in Inverse Finance’s contracts. In response, Curve is investigating all similar LlamaLend markets and designing changes for LlamaLend v2 to harden its handling of vault-based collateral and donation attacks, including stricter collateral configurations and more robust oracle integration. A governance proposal has also been introduced on Curve to recompensate borrowers who were liquidated in the affected sDOLA-long2 LlamaLend market, highlighting ongoing efforts to address user impact and refine risk controls for oracle-dependent DeFi lending.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• CRV price slides towards support amid LlamaLend pool exploit (crypto.news)
• Curve Finance Investigates sDOLA LlamaLend Attack - KuCoin (kucoin.com)
• Curve Finance: An investigation has been launched into the sDOLA ... (longbridge.com)
• We are investigating an attack targeting the sDOLA LlamaLend ... (panewslab.com)
• Curve Finance: The investigation into the sDOLA LlamaLend attack ... (rootdata.com)

Explore the topic

• Hacks
• LlamaLend
• Curve