INCIDENT DOSSIER / CASE 43114–E25C

One vault.
One broken claim.

A receipt-led reconstruction of the USDC exit from Fence’s Avalanche vault—separating what the chain proves from what third parties allege.

HIGH CONFIDENCE: FUNDS FLOWMEDIUM: MECHANISMUNKNOWN: SOLANA RECEIPT

CONFIRMED VAULT OUTFLOW$1,013,353^.611686

Canonical USDC · not TVL · not bridged gross

+21.400516 proven caller prefund +0.000001 helper dust

INCIDENT ANCHOR2026-10-28 00:00:03 UTC

VAULT0xE25C…621a

CUTOFF BLOCK98,765,376

DATA PLANEGateway-first / supplement disclosed

01 / THE 48-HOUR WINDOW

Preparation → extraction → exit

Show Zoom

Exact preparation lookback starts 2026-10-25 23:16:19 UTC · 48h before the earliest incident-linked canonical USDC funding. Fresh paginated activity cutoff: 2026-10-28 09:34:19 UTC. Indexed absence is not presented as zero activity.

02 / ROOT CAUSE

Accounting failure: evidence & limits

ASSESSMENT · MEDIUM

RECEIPT OBSERVATION

Zero retained cash, then an equal-sized claim.

The successful receipt proves the vault emitted 1,013,353.611686 USDC during a helper-mediated claim. The victim and helper are unverified and a complete call trace was unavailable, so the precise faulty source line and proxy implementation at the incident block are not established.

Blockaid allegation

A flash loan inflated tranche shares before claim. This is consistent with the preceding Aave interaction, but remains third-party attribution—not a locally proven code diagnosis.

REPRODUCIBLE ARITHMETIC / RAW 6 DECIMALS

vault transfer1,013,353,611,686

helper forward1,013,353,611,687

caller prefund+ 21,400,516

two CCTP burns= 1,013,375,012,203

1,013,353,611,687 + 21,400,516 − 1,013,375,012,203 = 0

Preparation: 1,013,353,611,686 − 1,013,353,611,686 = 0 raw retained USDC. After 202 seconds, the claim withdrew 1,013,353,611,686 raw. Cash movement alone does not establish unchanged total net assets: receivables and prior entitlements remain unresolved. Combined with Blockaid’s allegation, this supports a bounded accounting-failure assessment, not a proven share formula.

03 / FUNDS GRAPH

Conserved on Avalanche. Unmatched on Solana.

FENCE VAULT0xE25C…621a−1,013,353.611686

→receipt

HELPER0xF09D…7805+0.000001 dust

→forward

CALLER0x6FF1…1246+21.400516 prefund

↗ 250,000.175563

↘ 763,374.836640

CCTP DOMAIN 5CdcSn…2ocmRECEIPT UNKNOWN

Source-side burns succeeded. A destination mint, actual CCTP fee, account owner, present balance, and onward movement are not proven until the exact CCTP message hashes are matched to Solana receipts.

04 / PROTOCOL MAP

Roles, controls & dependencies

EVIDENCE BOUNDARIES SHOWN

Fence

Vault product surface

Official Fence product and API documentation describe asset-backed credit facility administration: loans, receivables, borrowing bases, covenants, waterfalls and cash management. Tranche claims are not AMM LP shares. Exact vault operator, fees and legal relationships remain unverified.

Valinor

Relationship unproven

Co-tagging and incident references suggest a technical/product relationship. They do not establish legal identity, ownership, or operational responsibility.

Proxy / admin

Control plane gap

Implementation address, admin, upgrade history, pause actions, and role assignments were not proven for the vault at the incident block.

Dependencies

USDC · Aave · CCTP

Canonical Avalanche USDC moved; Aave appears in preparation; Circle CCTP carried source burns. Dependency presence is not causal fault.

Audits

No audit mapped

No audit report was matched to the incident implementation. An audit claim without bytecode equivalence would not close this gap.

Tokenomics

Absent / not established

No protocol token, emissions, allocation, governance, or value-accrual evidence was found in this packet.

05 / COVERAGE LEDGER

What is stale, missing, or blocked

Plane	Status	Observation
Avalanche head	PINNED	Block 98,765,376 · 2026-10-28 09:34:19 UTC
Gateway receipts	UNAVAILABLE	Method outside dShares Gateway contract; no direct RPC fallback
Explorer pagination	EXHAUSTED	Vault/helper/caller transaction and ERC-20 pages refreshed; 50 in-window indexed rows total
Vault source / proxy	UNVERIFIED	No implementation-equivalent source or complete trace admitted
Solana receipt	BLOCKED	Four RPC transports failed before JSON-RPC response
Freshness	FRESH CUT	Refreshed 2026-10-28 09:34:22 UTC; frozen snapshot, not live state

Open dossier ↗