Rodeo Finance was a leveraged yield farming protocol on Arbitrum that enabled users to borrow USDC from a shared lending pool and deploy into high-APY strategies on Arbitrum (primarily GMX GLP, Curve Finance pools, Jones DAO strategies, and other Arbitrum DeFi yield sources) at 2–10x leverage, allowing yield seekers to amplify returns while lenders earned a base interest rate from borrower demand — that launched in early 2023 as one of several Arbitrum-native leveraged yield products, and suffered a $1.53 million oracle manipulation exploit in July 2023 in which an attacker manipulated Rodeo’s USDC price oracle via a flash loan attack on Uniswap v3, used the manipulated oracle to borrow excess funds, and drained the protocol, after which Rodeo Finance ceased normal operations.
How It Works
- Lending pools — Capital providers deposit USDC into Rodeo’s lending pool and receive ibUSDC (interest-bearing USDC) representing their share. Lenders earn yield from borrower interest.
- Leveraged positions — Borrowers post USDC collateral and borrow additional USDC from the pool to open a leveraged yield farming position. Rodeo deploys the combined capital into a selected DeFi strategy (e.g., GMX GLP — providing USD-denominated liquidity to GMX perpetuals; Curve stablecoin pools; Jones DAO USDC vault).
- Strategy execution — Rodeo automatically compounds rewards from the underlying strategy. The leveraged position’s total balance (collateral + borrowed USDC + strategy yield) is tracked against the outstanding loan. If the position’s health factor falls below the minimum threshold (position value < debt + minimum collateral), it is liquidated.
- Yield sources — Rodeo supported positions into GMX GLP (earning ETH from traded perpetuals), Curve 2pool on Arbitrum, Jones DAO USDC strategies, and other Arbitrum yield sources. Each strategy had a specific leverage cap based on its risk profile.
- No major governance token — Unlike many DeFi protocols, Rodeo Finance did not have a widely traded governance token at launch. The protocol operated as a standalone yield infrastructure play.
Use Cases
- Leveraged yield farming — Amplify Arbitrum yield farming returns with borrowed capital.
- USDC lending — Earn borrowing interest by providing USDC to leveraged farmers.
- GMX GLP exposure — Access leveraged exposure to GMX’s GLP yield (fees from GMX perpetuals trading).
History
- 2023-Q1 — Rodeo Finance launches on Arbitrum as part of a wave of Arbitrum-native DeFi protocols. The protocol’s leveraged yield products for GMX GLP and Curve attract initial TVL from Arbitrum DeFi users seeking amplified yields.
- 2023-Q1 to Q2 — Rodeo reaches approximately $10–15 million in TVL. The protocol integrates with GMX GLP as the primary yield strategy. Competition in Arbitrum leveraged yield farming includes Jones DAO, Umami Finance, and other protocols.
- 2023-07-11 — Rodeo Finance suffers a $1.53 million oracle manipulation exploit. The attacker uses flash loans to temporarily manipulate the price of USDC in Rodeo’s oracle (which relied on a Uniswap v3 TWAP with an insufficient observation window — approximately 10-minute TWAP, which can be manipulated in a single Arbirtum block at low cost). The manipulated oracle allows the attacker to borrow far more than collateral justifies, draining the lending pool.
- 2023-07 — Rodeo Finance publishes a postmortem acknowledging the oracle manipulation attack. The TVL of approximately $1.5M is lost. The team discusses recovery options.
- 2023-Q3 to Q4 — Rodeo Finance ceases normal operations following the hack. The protocol does not restart its leveraged yield products. The Rodeo domain and social media remain but no new development is published.
Common Misconceptions
“Rodeo Finance was a major Arbitrum protocol.”
Rodeo was a smaller Arbitrum-ecosystem protocol, never reaching the TVL scale of major Arbitrum DeFi protocols like GMX, Radiant Capital, Camelot, or Jones DAO. It operated at approximately $10–15M TVL before the hack.
“All TWAP oracles are equally safe.”
Rodeo’s TWAP oracle used too short an observation window for Arbitrum’s block times and flash loan conditions. On Arbitrum, which has lower blocks costs than Ethereum mainnet, a 10-minute TWAP can sometimes be manipulated in fewer blocks than expected. Proper TWAP oracle security requires sufficient observation windows relative to the cost of manipulation.
Social Media Sentiment
Rodeo Finance received limited coverage outside of Arbitrum DeFi communities before the hack. The July 2023 exploit was reported in DeFi security newsletters and Rekt News as a typical TWAP oracle manipulation case. The protocol is primarily remembered as a case study in oracle security for shorter-lived Arbitrum yield protocols.
Last updated: 2026-04