Raft Protocol
Summary
Raft Protocol was an Ethereum-based over-collateralized stablecoin protocol that allowed users to mint R, a USD-pegged stablecoin, against liquid staking derivative (LSD) collateral such as stETH and cbETH. On November 10, 2023, an attacker exploited a precision rounding error in the protocol's share-token minting contract using a flash loan, minting approximately $6.7 million in unbacked R stablecoins and draining roughly $3.3 million worth of ETH from the protocol. In a notable twist, the attacker lost money on the exploit — a coding error in their own attack script sent 1,570 ETH (~$3.25 million) to a burn address, leaving them with a net loss of approximately 4 ETH after gas and flash loan costs.
Connected Entities
1 entities · 10 linked investigationsTimeline(6 events)
2023-01-01
Raft Protocol launched on Ethereum mainnet as an LSDfi over-collateralized stablecoin protocol backed by stETH/cbETH collateral.
The Block2023-11-10
Attacker borrowed 6,000 cbETH via Aave flash loan, donated cbETH to inflate the collateral index in rcbETH-c contract, exploited a precision rounding error (divUp rounding up instead of down) to accumulate inflated share tokens, then redeemed them for cbETH and minted approximately 6.7 million unbacked R stablecoins.
CoinDesk2023-11-10
Attacker sold 6.7 million R tokens into Balancer and Uniswap liquidity pools, netting approximately 1,577 ETH (~$3.3M). A bug in the attacker's exploit script sent 1,570 ETH to a burn address, destroying ~$3.25M irreversibly. Attacker retained only 7 ETH, resulting in a net loss of ~4 ETH after the 18 ETH attack setup cost.
Web3 Is Going Great2023-11-10
R stablecoin lost its $1 peg, falling approximately 50% to around $0.50–$0.70. Raft paused all smart contract minting operations.
Bankless Times2023-11-11
Raft published official post-mortem identifying precision loss in share token minting as the root cause. Team announced police report filed and cooperation with law enforcement and centralized exchanges.
Mirror.xyz (Raft Official)2023-11-17
Raft published revised recovery plan setting a ~42% recovery rate for affected users and LPs, using protocol-owned sDAI from the Peg Stability Module.
Raft Governance ForumDecision Log
- hash: 4jJaSDdmPAorT9vpWn6ZvJdWK7YEqB1xdbb21FhJvBnG
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/1/2026, 5:48:52 PM
last updated: 6/1/2026, 5:48:55 PM
avoid.net — verified advice for a post-truth world