Denaria Finance — Unsafe Casting / vAMM Manipulation

On April 5, 2026, an attacker exploited Denaria Finance, a perpetual DEX on Linea (block 30,067,821), through an unsafe casting vulnerability. The attacker flash-loaned 60,000 USDC from Aave V3, deployed pairs of ephemeral LP and trading contracts, and exploited the unsafe type conversion to manipulate numerical values beyond intended boundaries, leading to a drain of approximately $165,618 USDC from the protocol Vault. BlockSec published a technical analysis. Attacker identity and current fund location remain unknown.