Inverse Finance exploited again for $1.2M in flashloan oracle attack

Share This Post

No user funds have been affected by the exploit, but Inverse Finance has incurred a debt and offered the attacker a bounty to return the stolen funds.

Just two months after losing $15.6 million in a price oracle manipulation exploit, Inverse Finance has again been hit with a flashloan exploit that saw the attackers make off with $1.26 million in Tether (USDT) and Wrapped Bitcoin (WBTC).

Inverse Finance is an Ethereum based decentralized finance (DeFi) protocol and a flashloan is a type of crypto loan that is usually borrowed and returned within a single transaction. Oracles report outside pricing information.

The latest exploit worked by using a flashloan to manipulate the price oracle for a liquidity provider (LP) token used by the protocol’s money market application. This allowed the attacker to borrow a larger amount of the protocol’s stablecoin DOLA than the amount of collateral they posted, letting them pocket the difference.

The attack comes just over two months after a similar April 2 exploit which saw attackers artificially manipulate collateralized token prices through a price oracle to drain funds using the inflated prices.

In response to the attack, Inverse Finance temporarily paused borrowing and removed its DOLA stablecoin from the money market while it investigated the incident, saying no user funds were at risk.

It later confirmed that only the attacker’s deposited collateral was affected in the incident and only incurred a debt to itself due to the stolen DOLA. It encouraged the attacker to return the funds in return for a “generous bounty”.

Related: Attackers loot $5M from Osmosis in LP exploit, $2M returned soon after

In total, the attacker’s gained 99,976 USDT and 53.2 WBTC from the attack, swapping them to ETH before sending it all through the cryptocurrency mixer Tornado Cash, attempting to obfuscate the ill-gotten gains.

The previous attack in April saw attackers make off with $15.6 million in ETH, WBTC, YFI and DOLA.

DeFi marketplace Deus Finance suffered from a similar exploit in March, with attackers manipulating a price pairing within an oracle leading to a gain of 200,000 Dai (DAI) and 1101.8 ETH worth over $3 million at the time.

Beanstalk Farms, a credit based stablecoin protocol lost all $182 million worth of collateral in a flash loan attack caused by two malicious governance proposals which in the end drained all funds from the protocol.

How the latest attack went down

Blockchain security firm BlockSec analyzed that the attacker borrowed 27,000 WBTC in a flashloan swapping a small amount to the LP token used to post collateral in Inverse Finance so users can borrow crypto assets.

The remaining WBTC was swapped to USDT, causing the price of the attacker’s collateralized LP token to rise significantly in the eyes of the price oracle. With the value of these LP tokens now worth far more due to the price rise, the attacker borrowed a larger amount than usual of the DOLA stablecoin.

The value of the DOLA was worth much more than the deposited collateral, so the attacker swapped the DOLA to USDT, and the earlier WBTC to USDT swap was reversed to repay the original flashloan.

Read Entire Article
spot_img
- Advertisement -spot_img

Related Posts

Bitcoin Bears Lose Control As BTC Net-Taker Volume Shifts Positive

Bitcoin has been on an impressive surge since early September, rising by 31% from local lows around $53,000 However, after testing the $69,500 supply level, the cryptocurrency faces selling pressure

Vietnam Unveils Ambitious Strategy to Become Regional Blockchain Hub

The Vietnamese government has unveiled a strategy to make Vietnam a leader in blockchain technology in Southeast Asia The strategy includes building blockchain brands, establishing testing centers,

Buterin proposes radical shift in Ethereum to reduce hardware requirements

Ethereum co-founder Vitalik Buterin has unveiled the latest roadmap phase, “The Verge,” which proposes a groundbreaking shift in blockchain technology to make transaction verification

Solana (SOL) Defies Crypto Market Trends, Eyes $190 Level

The post Solana (SOL) Defies Crypto Market Trends, Eyes $190 Level appeared first on Coinpedia Fintech News The ongoing selling pressure across the cryptocurrency market has shifted the overall

5 Million Strong: Active Ethereum Wallets Drive Strong Momentum

According to veteran trader Peter Brandt, Ethereum might have just seen its future looking brighter Known for his technical forecasts, Brandt feels the altcoin is on the verge of a bullish turnaround

ECB’s Anti-Bitcoin Propaganda Debunked In Scathing Academic Rebuttal

As a response to the latest anti-Bitcoin paper by the European Central Bank (ECB), a new academic paper titled “Challenging Bias in the ECB’s Bitcoin Analysis” has been published