Ribbon Finance, which has partially rebranded to Aevo, has lost $2.7&nbsp;million after attackers exploited a vulnerability in the <button class="define-target" id="smart-contract">smart contract</button> for legacy Ribbon vaults that enabled them to manipulate <button class="define-target" id="oracle">oracle</button> prices and withdraw a large amount of ETH and USDC.<p>Ribbon has announced it will cover $400,000 of the lost funds with its own assets. However, Ribbon is also offering users a lower-than-expected haircut on their assets by assuming that some of the largest affected accounts will not withdraw their assets, having been dormant for several years. While this plan may benefit active users, it seems like it could get very messy if those dormant users do wish to withdraw their assets and discover they've been used to pay others.</p>

Archived tweet

Tweet by Aevo (fka Ribbon Finance):