Fence Tranche Pool: Day-Rollover Accounting Reopened ~1.013M USDC Draw

~1.013M USDC, per SlowMist; ~$1.01M, per CertiK. On-chain: the exploit tx moved 1,013,353.61 USDC out of the pool.

Root cause: Per SlowMist and BlockSec Phalcon: at the UTC day rollover the settlement logic treated a scheduled principal payment as received though nothing was repaid. The draw check ignored matured-but-unpaid principal, so the full draw allowance reopened. Per Defimon, tranche configuration is caller-supplied, so anyone can open a tranche and be its borrower.

Timeline, as sourced: Setup 27 Oct 2026 23:56 UTC (per Defimon); exploit tx 28 Oct 00:00:03 UTC (on-chain). No Fence post-mortem found.

Avalanche C-Chain, 28 Oct 2026, 00:00 UTC. A USDC TranchePool (0xe25cb545…7621a) that SlowMist reports as associated with Fence, Valinor and Oatfi (SlowMist (opens in a new tab)).

Per Defimon (analysis (opens in a new tab)): tranche configuration is supplied by the caller and checked only against a stored hash, and opening a tranche requires only being the admin named in that configuration, so anyone can open one and be its borrower. At 23:56 UTC on 27 Oct the attacker's contract flash-loaned 1,013,353.61 USDC from Aave V3, opened a tranche with itself as lender, admin and borrower, scheduled a principal repayment due 00:00 UTC, and drew the deposit back out to repay Aave.

Per SlowMist and BlockSec Phalcon (Phalcon (opens in a new tab)): at the day rollover the settlement logic treated the scheduled principal as received and subtracted it from outstanding principal, though nothing was repaid. The draw check (deposited minus outstanding) ignored matured-but-unpaid principal, which the lender-withdrawal path does subtract. The full allowance reopened, and a second draw paid out other lenders' USDC. On-chain, the exploit tx moved 1,013,353.61 USDC out of the pool at 00:00:03 UTC (tx (opens in a new tab)). CertiK puts the loss at ~$1.01M (CertiK (opens in a new tab)).

Fence, in an on-chain message to the attacker, offered a 10% recovery bounty (relayed by Defimon (opens in a new tab)).

Unknown: whether funds are returned; a Fence post-mortem. The contract is unverified, per Defimon.

Pattern: two paths reading the same debt must subtract the same things. When the borrow check and the withdraw check disagree, the gap is a loan.