Sonne Finance Incident Analysis

## Executive summary On 14 May 2024 Sonne Finance (a Compound V2 fork) was exploited for approximately $20M by abusing a known precision-loss/rounding vulnerability: the attacker inflated the soVELO exchangeRate by donating borrowed VELO to an empty market, then exploited truncation in redeemUnderlying to redeem disproportionate underlying assets with fewer soTokens, repeating the technique to drain multiple markets; the report includes transaction hashes, attack timeline, fund tracing and attacker/victim addresses.