More Markets / ankrFLOW: Unbacked LST Minting + Aave E-Mode Drains $9.3M on Flow EVM

An attacker exploited a flaw in Ankr's ankrFLOW liquid-staking contract to mint ~8.6M unbacked ankrFLOW tokens on Flow EVM, then leveraged Aave V3 efficiency mode (e-mode) to borrow 15.5M WFLOW (~$9.3M) from More Markets' lending reserve against that synthetic collateral.

Root Cause

The vulnerable component was Ankr's ankrFLOW liquid-staking token (LST) contract deployed on Flow EVM. The contract contained a flaw that allowed minting ankrFLOW without depositing the corresponding FLOW backing. ankrFLOW is a reward-bearing token: its exchange rate vs. FLOW increases over time as staking rewards accumulate (the balance stays constant but each token redeems for more FLOW). This made it a natural candidate for Aave V3 e-mode, which grants higher loan-to-value ratios for "correlated" assets.

// Simplified ankrFLOW — VULNERABLE mint path (conceptual)
function mint(address to, uint256 shares) external {
    // BUG: missing msg.value / FLOW deposit check
    // attacker calls with zero FLOW backing
    _mint(to, shares);  // unbacked shares created
}

// More Markets e-mode configuration (Aave V3)
// E-Mode LTV for ankrFLOW/WFLOW pair: 95%  <-- high LTV for "correlated" assets
// Standard collateral LTV: 65%

E-mode is designed to let users maximize borrowing power when collateral and debt are correlated (e.g., staked ETH vs ETH). The attacker weaponized this by producing synthetic ankrFLOW collateral that appeared correlated with WFLOW without the economic backing.

Attack Steps

Step	Action	Detail
1	Exploit Ankr contract	Minted ~8.6M ankrFLOW without FLOW collateral
2	Supply to More Markets	Deposited ankrFLOW as collateral into the lending pool
3	Enable e-mode	Activated ankrFLOW/WFLOW e-mode for 95% LTV
4	Borrow WFLOW	Borrowed 15.5M WFLOW from the protocol's entire lending reserve
5	Swap & exit	Swapped WFLOW to other assets; experienced heavy slippage (~$246K realized)

Impact

WFLOW drained: 15.5M WFLOW tokens
Protocol estimate: ~$9.3M (Blockaid initial estimate)
Flow Foundation estimate: ~$410K at WFLOW spot price
Realized by attacker: ~$246K (after slippage on thin WFLOW liquidity)
Chain: Flow EVM
Date: August 31, 2026
Actual loss discrepancy: The gap between nominal $9.3M and realized $246K reflects extremely thin WFLOW liquidity on Flow EVM — the token had insufficient market depth to realize face value.

Note: Blockaid later clarified the vulnerable contract was Ankr's LST, not Flow EVM or More Markets' own code. More Markets itself (an Aave V3 fork) behaved as designed; e-mode operated correctly against what the oracle reported as valid collateral.

Lessons for Auditors

LST collateral onboarding requires LST contract audits. When a lending protocol lists a new liquid-staking token as collateral, it must audit the LST's minting logic — not just the oracle and price feed. An unbacked LST defeats the collateral model entirely.
E-mode amplifies collateral risk. High-LTV e-mode is appropriate only for LSTs whose backing mechanism is cryptographically enforced. Require on-chain proof-of-reserve or a locked-deposit invariant before enabling e-mode for a new LST.
Thin-liquidity collateral + e-mode is critical-severity. Any collateral asset with shallow market depth that also qualifies for e-mode creates an asymmetric attack surface: small capital to mint/acquire → large WFLOW borrow → dump on exit.
Separate LST mint access control. LST contracts must enforce that mint() is only callable after verified FLOW deposit. Use require(msg.value == expectedFlow) or an equivalent deposit-first pattern; never allow external mint without ledger proof.
Correlated-asset assumptions must be tested at the contract level. E-mode "correlation" is an economic assumption; it must be backed by an on-chain invariant or a circuit-breaker that disables e-mode if the LST's backing ratio drops below a threshold.