Technical Vulnerability: The vUSD Logic Flaw

Allbridge Core has suffered two major flash loan exploits—one in April 2023 (BNB Chain) and another in July 2026 (Solana)—resulting in combined losses of approximately $2.22 million. These exploits slipped through audits primarily due to a fundamental logic flaw in the protocol's virtual USD (vUSD) pool mechanics that auditors treated as an "economic risk" rather than a code bug.

Technical Vulnerability: The vUSD Logic Flaw

The core vulnerability centered on the protocol's withdraw function and its internal accounting token, vUSD. The protocol assumed a symmetric mint/burn ratio, meaning it would mint and burn the same amount of vUSD during deposits and withdrawals regardless of the pool's actual balance [Source: https://allbridge.medium.com/allbridge-core-exploit-post-mortem-7e6c2522fee4].

Attackers exploited this by:

1. Flash Loaning large amounts of stablecoins to heavily skew the pool ratio.
2. Manipulating the Price: By acting as both a Liquidity Provider (LP) and a swapper in a single atomic transaction, the attacker could withdraw liquidity at a manipulated rate.
3. Extraction: In the 2023 attack, swapping just $40,000 of BUSD allowed the attacker to extract $790,000 in BSC-USD—a nearly 20x return [Source: https://allbridge.medium.com/allbridge-core-exploit-post-mortem-7e6c2522fee4].

Audit Gaps and Failures

Despite multiple security reviews by firms such as Kudelski Security, CoinFabrik, and Quarkslab, the vulnerability persisted for several reasons:

Primary Reasons for Failure:

• Out-of-Scope Vectors: Bug bounty programs, such as the one hosted on HackenProof, explicitly listed "flash loan/oracle manipulation" as out-of-scope, categorizing them as economic risks rather than technical bugs [Source: https://hackenproof.com/allbridge/allbridge-core].
• Edge Case Blindness: Auditors typically test "happy path" scenarios. The exploit required extreme pool imbalance that was not modeled during standard security reviews.
• Deferred Fixes: The 2024 Quarkslab audit identified a medium-severity risk (MED-1) where liquidity could be drained. Allbridge acknowledged the risk but deferred the fix to a future DAO implementation that was not completed before the 2026 exploit [Source: https://quarkslab.com/blog/allbridge-core-security-audit/].

Summary of Exploits

The recurrence of a nearly identical exploit on July 20, 2026, suggests that the fundamental architectural risks identified in 2023 were either not fully remediated or were reintroduced during the Solana deployment [Source: https://x.com/OnchainLens/status/1814550146000].