# Fence Finance — Avalanche incident dossier

**Vault:** `0xE25CB545Bdd47a8Ec2d08001cb5661B00D47621a`  
**Incident anchor:** block `98,731,606`, `2026-10-28T00:00:03Z`  
**Saved activity cutoff:** block `98,743,018`, `2026-10-28T03:15:31Z`  
**Fresh Gateway head check:** block `98,765,376`, `2026-10-28T09:34:19Z`  
**Status:** frozen educational reconstruction; destination receipt and current state are not established.

## Executive finding

A successful Avalanche receipt proves that the named vault transferred **1,013,353.611686 canonical USDC** to a newly created helper, which forwarded **1,013,353.611687 USDC** to the caller. The one-micro-USDC difference was helper dust. The caller also held **21.400516 USDC** before the extraction. Two successful Circle CCTP source burns then consumed **250,000.175563 + 763,374.836640 = 1,013,375.012203 USDC** toward Solana domain 5.

The source-side accounting closes exactly in raw six-decimal units:

```text
1,013,353,611,687 helper forward
+      21,400,516 caller prefund
- 1,013,375,012,203 CCTP gross burns
=                  0
```

Only **1,013,353.611686 USDC** is confirmed vault outflow. The larger bridged gross is not stolen principal: it also contains the prefund and helper dust. A Solana mint receipt, actual CCTP fees, present balance, and onward movement remain unknown.

## Protocol and business model

Fence presents a vault product surface and a public communications account at [@fence_finance](https://x.com/fence_finance). The admitted evidence packet does not establish the operating entity, legal domicile, fee schedule, revenue model, customer eligibility, active product inventory, or incident response communications. These are evidence gaps, not zero values.

The observed mechanism is vault-like: users or strategies hold an economic claim represented by accounting units or shares, and a claim path releases an underlying asset. The incident receipt proves an asset release; it does not, by itself, prove the intended deposit, tranche, redemption, or fee mechanics.

### Tokenomics

No Fence protocol token, emissions schedule, allocation, governance rights, buyback, or value-accrual design was established. **Tokenomics: absent / not evidenced.** USDC is an underlying asset, not evidence of a Fence token.

## Roles and control plane

| Role | Evidence-backed conclusion | Confidence |
|---|---|---|
| Fence | Public protocol/product identity associated with the vault incident | Medium |
| Valinor | Co-tagged in incident material; technical/product relationship plausible | Low |
| Vault | Emitted 1,013,353.611686 USDC in the successful receipt | High |
| Helper | Newly created unverified contract; received and forwarded vault USDC | High |
| Caller | Deployed/called helper and initiated CCTP burns | High |
| Admin / owner | Not identified from admitted evidence | Unknown |
| Proxy implementation | Not resolved at incident block | Unknown |

Fence and Valinor must not be treated as the same legal entity, owner, operator, or responsible party merely because they were co-tagged. No private wallet-owner labels are asserted.

## Proxy, upgrades, pauses, and audits

The evidence packet does not establish whether the vault was a proxy, which implementation executed at block 98,731,606, the admin or role holders, upgrade events, pause state, or response actions. No source tree was matched byte-for-byte to the runtime implementation. No audit report was mapped to that implementation. Therefore:

- no exact vulnerable source line is claimed;
- no administrator omission or upgrade is claimed;
- no audit coverage or audit failure is claimed;
- a later source publication would still require runtime-bytecode and constructor/immutable equivalence.

## Root-cause assessment

### Locally proven

The claim transaction succeeded and released vault assets to the helper. The independent reviewer’s preparation receipt shows +1,013,353,611,686 − 1,013,353,611,686 = 0 raw retained USDC, followed 202 seconds later by an equal-sized claim. Cash movement alone does not prove unchanged total net assets: receivables and prior entitlements may differ. Combined with Blockaid’s incident attribution, this supports a bounded economic accounting-failure assessment, not standalone proof of unbacked shares or a particular source defect. See [review integration](REVIEW-ADDENDUM.md).

### Third-party allegation

Blockaid reportedly attributed the incident to a flash loan that inflated tranche shares before claim. A preceding interaction involving Aave V3 is consistent with preparation. Because the victim/helper source is unverified and a complete call trace was unavailable, this dossier does **not** assert the exact inflation formula, storage mutation, or exploitable source line. It performs no assert replay and no live exploit reproduction.

### Reproducible arithmetic

The exact arithmetic above proves conservation after extraction. It does not prove the alleged share-inflation mechanism. A source-level conclusion requires: implementation address at the incident block, verified or reconstructed runtime-equivalent code, the relevant pre/post storage values, and a complete call trace.

## 48-hour timeline

The requested window opens at `2026-10-25T23:16:19Z`, exactly 48 hours before the earliest incident-linked canonical USDC funding. Fresh vault/helper/caller transaction and ERC-20 pages were exhausted or crossed the boundary through the cutoff. An absent indexed record is not represented as zero activity.

| UTC | Block | Event | Evidence status |
|---|---:|---|---|
| 2026-10-25 23:16:19 | — | 48-hour lookback opens | Coverage boundary |
| 2026-10-27 23:16:19 | 98,729,223 | Caller receives 44.655284 canonical USDC preparation funding | Indexed transfer |
| 2026-10-27 23:41:49 | 98,730,612 | Caller creates helper | Indexed transaction |
| 2026-10-27 23:56:39 | 98,731,441 | USDC preparation transfer | Indexed transaction |
| 2026-10-27 23:56:41 | 98,731,443 | Helper preparation call; Aave interaction reported in prior analysis | Mechanism not fully traced |
| 2026-10-28 00:00:03 | 98,731,606 | Vault → helper → caller extraction | Successful receipt |
| 2026-10-28 00:03:41 | 98,731,831 | CCTP burn 250,000.175563 USDC | Successful source receipt |
| 2026-10-28 00:05:22 | 98,731,940 | CCTP burn 763,374.836640 USDC | Successful source receipt |
| 2026-10-28 03:16:23 | 98,743,070 | Unrecognized successful caller self-call, selector `0x546f2074`; no canonical-USDC transfer | Purpose unknown |
| 2026-10-28 09:34:19 | 98,765,376 | Fresh Avalanche evidence cutoff | Pinned head |
| 2026-10-28 03:23:05 | — | Solana provider attempts exhausted | Transport blocked |

No admin upgrade, pause, or protocol response event was proven in the admitted window. Publication times must not be substituted for event times.

The canonical Gateway was rechecked at `2026-10-28T09:34:19Z` and returned block `98,765,376` with hash `0xef3d…b0f4`. RouteScan address pages were freshly repaginated for all three addresses. They contain 0/5 vault top-level transactions/ERC-20 transfers, 3/8 helper rows, and 21/13 caller rows in-window. Counts include duplicate transaction perspectives and non-canonical tokens; they are coverage counts, not incident totals. A token named USDC at another contract was excluded from canonical-USDC accounting. No direct upstream RPC was used.

## Dependencies and risks

- **Canonical Avalanche USDC:** asset transferred and burned; issuer controls and blacklist risk remain external dependencies.
- **Aave V3:** appears in preparation; dependency presence does not establish Aave fault.
- **Circle CCTP v2:** source burns were successful. Cross-domain completion is asynchronous and requires destination message matching.
- **Explorer supplement:** RouteScan supplied methods outside the canonical Gateway contract; explorer interpretation and availability are dependencies.
- **Unverified code:** prevents source-level root-cause and privilege claims.
- **Cross-chain attribution:** source burns cannot prove destination receipt, holder, or recovery status.

## Data plane and provenance

The canonical consumer plane is the loopback **avax-radar Gateway** at `/api/gateway/dshares/rpc`. It pinned the head but rejected transaction and receipt methods as outside the dShares Gateway contract. There was **no silent direct-RPC fallback**. Saved RouteScan API responses are disclosed supplements for transaction, receipt, and exhausted address-page evidence. Destination Solana RPC attempts failed before JSON-RPC responses across four providers.

## Artifacts

- [Dashboard source](../../../fence-incident-dashboard/README.md)
- [Funds-flow report](../../../research/fence-funds-flow-20261028/REPORT.md)
- [Destination boundary](../../../research/fence-funds-flow-20261028/REPORT-SOLANA.md)
- [Transaction explanation](../../../research/transaction-explanations/2026-10-28-3f6b2329/REPORT.md)
- [Educational wiki](../../docs/wiki/fence.md)
- [Fresh Gateway cutoff](fresh-cutoff.json)

## Reproduction and limits

Run `node research/fence-funds-flow-20261028/verify.mjs` from the workspace to verify the eight saved arithmetic/source checks. Run dashboard checks from `fence-incident-dashboard/` with `npm run check && npm run build`. The app uses a frozen snapshot and must not be read as live TVL, current balances, response state, or destination receipt status.