★ Empty cToken-style market (zero supply/borrow)
BENQI's assessment for RD-F-070 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
STAR CRITICAL FACTOR. BENQI Liquidity Market is a Compound V2 fork (qiToken = cToken architecture). The donation/empty-market exchange-rate-inflation vulnerability class applies structurally. Conditions for exploit: a market must have near-zero totalSupply, enabling a small minter to acquire nearly all shares, then donate tokens directly to the contract to inflate the exchange rate, then drain other markets. Active qiToken markets are NOT empty — aggregate supplied $277.64M, borrowed $50.19M, with individual markets (qiAVAX holding ~495K-502K AVAX per Snowtrace tx history) having substantial non-zero supply. However: (1) BENQI GitHub repo (last commit 2023-01-11) predates post-Sonne-Finance (May 2024) and post-Hundred-Finance (April 2023) mitigations; no evidence of virtual-share offset or enforced minimum seed-deposit code introduced; (2) qiBUSD market may be deprecated with near-zero supply (BUSD discontinued Feb 2023) — status unconfirmed on-chain; (3) Isolated Markets (newer ~2024)
Sources #
- GitHubBENQI GitHub — BENQI-Smart-Contracts (last commit 2023-01-11)BENQI Smart Contracts GitHub repository — last commit 2023-01-11, predating known empty-market mitigations. Lending/ directory contains cToken-style code with no confirmed virtual-share offsetretrieved 2026-05-16
- BENQI — Risks & Audits documentationBENQI risks and audits documentation — Halborn initial lending audit May 2021, Certora sAVAX formal verification Apr 2022; neither addresses post-2022 empty-market vulnerability classretrieved 2026-05-16
- Halborn — Sonne Finance Hack Explained (May 2024)Halborn explainer on Sonne Finance empty-market exploit (Compound V2 fork, May 2024, $20M loss) — confirms the vulnerability class applies to all Compound V2 forksretrieved 2026-05-16
- https://rekt.news/hundred-rekt2/retrieved 2026-05-16
Methodology #
Determine whether any listed Compound V2-fork market has `totalSupply == 0` and `totalBorrow == 0`, the precondition for a donation-exploit.
See the full factor methodology and distribution across all protocols →