Member
- Joined
- Oct 14, 2023
- Messages
- 225
- Thread Author
- #1
The Onyx Protocol DeFi landing platform lost approximately $2.1 million as a result of an illiquid market exploit deployed on October 27.
PeckShield experts probably noticed the incident when the protocol team didn't know about it yet.
According to the company's specialists, the attackers took advantage of a well-known rounding problem in the popular fork of Compound v2, which is the basis of the Onyx architecture.
Unknown people used this bug in April to hack into Hundred Finance in the amount of approximately $7 million.
PeckShield experts explain the attack mechanism on Onyx:
"In essence, the exploited oPEPE market was deployed five days ago without any liquidity. The pool was filled with borrowed funds, which were then repaid due to the rounding problem."
Attackers used instant loans to attract resources for an attack and manipulate exchange rates, a BlockSec representative said in a comment to The Block.
On-chain data shows that Onyx hackers have already sent 750 ETH (~$1.25 million) to the Tornado Cash mixing service.
#PeckShieldAlert @OnyxProtocol has been exploited for ~2.1MYou do not have permission to view link Log in or register now.
— PeckShieldAlert (@PeckShieldAlert) November 1, 2023
PeckShield experts probably noticed the incident when the protocol team didn't know about it yet.
According to the company's specialists, the attackers took advantage of a well-known rounding problem in the popular fork of Compound v2, which is the basis of the Onyx architecture.
Unknown people used this bug in April to hack into Hundred Finance in the amount of approximately $7 million.
PeckShield experts explain the attack mechanism on Onyx:
"In essence, the exploited oPEPE market was deployed five days ago without any liquidity. The pool was filled with borrowed funds, which were then repaid due to the rounding problem."
The @OnyxProtocol hack leads to ~$2.1M loss by exploiting a known rounding issue behind the popular CompoundV2 fork.
Basically, the exploited oPEPE market was deployed 5 days ago without any liquidity. This empty market was abused with donation to borrow funds from other…You do not have permission to view link Log in or register now.pic.twitter.com/fbHdZhTz0E
— PeckShield Inc. (@peckshield) November 1, 2023
Attackers used instant loans to attract resources for an attack and manipulate exchange rates, a BlockSec representative said in a comment to The Block.
On-chain data shows that Onyx hackers have already sent 750 ETH (~$1.25 million) to the Tornado Cash mixing service.