In a significant security incident for the decentralized finance (DeFi) sector, legacy smart contracts from Ribbon Finance, now part of the Aevo ecosystem, were exploited for approximately $2.7 million on December 12. The attack targeted Ribbon's DeFi Options Vaults (DOV), structured products that once held over $300 million in total value locked (TVL) during DeFi's peak. These vaults remained active on the Ethereum mainnet despite Ribbon Finance's 2023 rebrand and transition into the derivatives exchange Aevo.
The exploit stemmed from a critical vulnerability introduced during an oracle infrastructure upgrade on December 6. According to detailed analysis by security researchers, the upgrade to the Opyn/Ribbon oracle stack "let anyone set prices for new assets," inadvertently enabling price manipulation. The attacker exploited this flaw by pushing arbitrary expiry prices for assets including wstETH, AAVE, LINK, and WBTC into the shared oracle at a common expiry timestamp, draining funds from the vaults.
Aevo's response was swift and transparent. The team confirmed that its primary Layer 2 exchange remained unaffected. All legacy Ribbon vaults have been stopped and will be decommissioned immediately. To mitigate user losses, Aevo proposed a recovery plan: while the vaults suffered roughly 32% in losses, user withdrawals will be subject to only a 19% reduction. This is possible because the Aevo DAO will forfeit its own vault positions (worth about $400,000) to partially offset the theft, reducing net losses to $2.3 million. The team also cited expected dormancy from large, inactive depositors.
A six-month claim window from December 12 to June 12, 2025, has been established. After this period, the DAO will liquidate remaining assets and distribute them to users who previously withdrew, aiming to compensate for the missing 19%.
This incident underscores the persistent threat of oracle manipulation in DeFi, following similar exploits like the $717,000 loss suffered by Venus Protocol on ZKsync earlier in the year. It highlights the critical importance of rigorous testing for upgrades, especially to core infrastructure like price feeds.
