GoМining

Tender.fi

<p>In the latest development in the world of Decentralized Finance (DeFi), Tender.fi, a DeFi lending protocol, fell victim to a white hat attack. The alleged <a href="https://www.numencyber.com/what-is-ethical-hacking/" rel="noopener noreferrer nofollow">ethical hacker</a> behind the attack had managed to drain a whopping $1.6 million from the platform, forcing the service to halt borrowing while it attempts to recover its assets.</p><p>The attack, which took place on Mar-07-2023 at 08:21:38 AM +UTC, has caused significant concern among the DeFi community. According to Numen Cyber's <a href="https://twitter.com/NumenAlert/status/1633105407836028928?s=20" rel="noopener noreferrer nofollow">on-chain monitoring</a>, the attacker siphoned 198 ETH, 541700 USDC, 16 WBTC, 8798 UNI, 50011 DAI, 36700 USDT, 24975 FRAX, and 16,203 LINK, causing the native token of the Tender.fi (TND) project to fall by over 30% before recovering slightly after the recovery of funds.</p><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/a0bdb8ad2b3b4b63a07c486d6694121e.jpeg"><h2 id="header-0">Timeline of Events</h2><p>Tender.fi confirmed an incident on March 7th that led to the depletion of funds after various community users raised concerns. Tender.fi took to <a href="https://twitter.com/tender_fi/status/1633046169055281153?s=20" rel="noopener noreferrer nofollow">Twitter</a> to acknowledge the issue and announced that they were investigating an unusually high amount of borrows, which led to the depletion of funds. As a result, the platform temporarily halted all borrowing activities until the investigation was complete.</p><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/7e618d64f2024170b04b5229ba01d934.jpeg"><p>The native token of Tender.fi (TND) plummeted over 30% in response to news of a suspected black hat hacking incident. The market reacted swiftly, with investors reacting to the news of the platform's loss of funds.</p><h2 id="header-1">Vulnerability Details</h2><p>The attack on Tender.fi has exposed a critical flaw in the platform's <a href="https://www.numencyber.com/what-is-a-smart-contract-audit/" rel="noopener noreferrer nofollow">smart contract code</a>, specifically its price oracle, which allowed the attacker to exploit the system and make off with $1.6 million worth of cryptocurrencies. The attacker was able to obtain <em>tGMX</em> tokens by purchasing them with initial funds and then proceeded to borrow using the <em>tETH.borrow</em> method. However, the borrowing process had an error in the price calculation, specifically in the <em>GMXPriceOracle.getUnderlyingPrice</em> method.</p><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/2be5a41ef8404550ae1ad305cc539ca1.png"><p>The initial price was multiplied by both 1e20 and 1e10, resulting in a significant increase in the price of <em>tGMX</em> tokens. This allowed the attacker to borrow large sums of money, which eventually led to the loss of millions of dollars in funds for Tender.fi.</p><p>Attacker’s address:</p><p><a href="https://arbiscan.io/address/0x896DF3759205C141c97640B2B7345FA479FEB1aB" rel="noopener noreferrer nofollow">https://arbiscan.io/address/0x896DF3759205C141c97640B2B7345FA479FEB1aB</a></p><p>Transaction:</p><p><a href="https://arbiscan.io/address/0x896DF3759205C141c97640B2B7345FA479FEB1aB" rel="noopener noreferrer nofollow">https://arbiscan.io/address/0x896DF3759205C141c97640B2B7345FA479FEB1aB</a></p><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/2a43bf18c7d14db1b0f97cda7f5757e1.png"><h2 id="header-2">Post-Mortem</h2><p>Tenderfi has rewarded a bounty of 62 ETH, which is approximately 6% of the exploited funds, to the White Hat. This amount is consistent with the industry standard for rewarding white hats who find and report security vulnerabilities. The White Hat who discovered the exploit promptly notified the Tenderfi team, who then worked quickly to repay the exploited funds.</p><p>Following the transaction's completion, Tender.fi took to Twitter to confirm that their funds were officially secure. The platform also announced that it would conduct a post-mortem analysis of the attack to identify areas of improvement and prevent similar incidents in the future. Their native token, TND has since bounced back slightly since the recovery of funds.</p><img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/7b00645125db4b59a551074576433360.png"><h2 id="header-3">Conclusion</h2><p>The swift and cooperative response from both the White Hat and the Tenderfi team is highly commendable. This type of collaboration between security researchers and blockchain companies is critical to creating a safer and more secure ecosystem.</p><h2 id="header-4">Note</h2><p>This article was originally posted on our website’s <a href="https://www.numencyber.com/resources/blog/" rel="noopener noreferrer nofollow">blog</a>.</p><p>Please stay tuned and follow our <a href="https://twitter.com/numencyber" rel="noopener noreferrer nofollow">Twitter @numencyber</a> for any future updates.</p>

The White Hat Attack on DeFi Protocol Tender-Fi: What You Need to Know

Table of Contents

Numen Cyber

Other articles published on Mar 9, 2023

Crypto.com Adds Apple Pay Support For Visa Cards in Brazil

Coinbase Introduces ‘Wallet as a Service’ To Boost Web3 Accessibility

[Community Insights] Confessions of a Crypto Trader: How Shorter Protected My Position During Mar...

Final Report of WEMIX Buyback & Burn(3 of 3) [2,316,396.65 WEMIX]

Yuga Labs slammed by Ordinals creator for “Degenerate” Bitcoin NFT auction

Nautilus Facility Launches 8,000 TeraWulf Rigs for Nuclear-Powered Mining

Join our free newsletter for daily crypto updates!