Summary
Sturdy Finance V1 was a DeFi lending protocol that allowed users to earn yield on deposits while borrowers accessed interest-free loans backed by staked collateral. On June 12, 2023, an attacker exploited a read-only reentrancy vulnerability in the protocol's price oracle integration — a third-party flaw originating in Balancer — and drained approximately 442 ETH (roughly $800,000). Sturdy V1 paused markets immediately, reopened its stablecoin market within days, and later formally sunset V1 in favor of Sturdy V2, which launched in early 2024 with a redesigned, modular architecture and three additional audits.
Connected Entities
1 entities · 10 linked investigations- + 9 more
Timeline(14 events)
2021-08-01
Sturdy Finance founded by Sam Forman; included in Y Combinator W21 batch.
The Org / Crunchbase2022-02-01
CertiK completes first security audit of Sturdy V1 smart contracts.
Sturdy V2 Security and Audits Docs2022-03-01
Sturdy Finance raises $4.4M seed round from Pantera Capital, Y Combinator, SoftBank, KuCoin Ventures, and others.
Extruct AI / Crunchbase2022-12-13
Quantstamp completes first audit of Sturdy V1; report notes oracle risk outside audit scope.
Quantstamp Certificate2023-06-12
Attacker exploits Balancer read-only reentrancy via the B-stETH-STABLE price oracle, draining approximately 442 ETH (~$800,000) from Sturdy V1. Sturdy pauses all markets. Stolen ETH deposited into Tornado Cash within 20 minutes.
CoinTelegraph / Rekt News2023-06-13
Sturdy founder Sam Forman publicly addresses the incident; team offers $100,000 bounty for recovery assistance.
CoinTelegraph / CryptoNews2023-06-15
Sturdy Finance reopens stablecoin market, approximately three days after the exploit.
CoinTelegraph2023-10-13
ChainSecurity completes audit of Sturdy V2 aggregator smart contracts.
ChainSecurity / Sturdy V2 Security and Audits Docs2024-02-01
Sturdy V2 launches publicly with a modular, siloed-pair architecture across multiple chains.
Sturdy Medium / Curve Substack2024-04-28
Sturdy governance forum publishes proposal to formally sunset Sturdy V1, citing 6+ months of inactivity and contributor-time drain.
Sturdy Governance ForumDecision Log
- #3review approve with notes+13⛓ pending8/18/2026, 8:31:17 PMhash: 368DFwkc1q1NoEDz4uzp9Syj21tGXzAt6eMjxoaKwkYP
- #2review⛓ pending8/18/2026, 8:31:17 PMhash: 2TwDViSRps6STEF21feyXBLnkjbvXRu4NnbFQLBBz3Hb
- hash: Fs5zX9XgYpnssc61ZtjEwpi1Dep3d8Mu2ARZJ7ijQMrS
This investigation is cryptographically anchored to the Solana blockchain (1 event). 11 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:41 AM
last updated: 8/19/2026, 6:33:34 AM
avoid.net — verified advice for a post-truth world