Radiant

Arbitrum

Radiant Capital

Million

USDC

<p>The post <a href="https://coinpedia.org/news/radiant-capital-suspends-operations-on-arbitrum-following-4-5-million-exploit/">Radiant Capital Suffers $4.5M Flash Loan Exploit, Suspends Operations</a> appeared first on <a href="https://coinpedia.org">Coinpedia Fintech News</a></p> 
<p>In a gripping turn of events, Radiant Capital, a leading cross-chain lending protocol, has momentarily frozen its lending and borrowing avenues on the Arbitrum network. This decision comes hot on the heels of a meticulously orchestrated exploit, draining a staggering $4.5 million (equivalent to 2337 ETH) from its recently inaugurated USDC Coin (USDC) markets.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Today, we received a report of an issue with the newly created native USDC market on Arbitrum. After validation by Radiant developers and the wider Web 3 security community, the Radiant DAO Council paused lending/borrowing markets on Arbitrum temporarily while this is…</p>— Radiant Capital (@RDNTCapital) <a href="https://twitter.com/RDNTCapital/status/1742338729925112272?ref_src=twsrc%5Etfw">January 3, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<h2 class="wp-block-heading" id="h-details-of-the-flash-loan-attack"><strong>Details of the Flash Loan Attack</strong></h2> 
<p>Radiant’s tech team, working alongside cybersecurity experts, identified the breach as a flash loan attack. The issue stemmed from a subtle rounding discrepancy in the protocol’s code. Beosin, a leading blockchain security firm, highlighted how this rounding problem led to an unexpected precision error.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Radiant Capital <a href="https://twitter.com/RDNTCapital?ref_src=twsrc%5Etfw">@RDNTCapital</a> was under a flash loan attack with a loss of $4.5M.<br>Attacker: <a href="https://t.co/L7fXlF8VXP">https://t.co/L7fXlF8VXP</a><br><br>The attacker manipulated the index parameter (which later served as a denominator) to become extremely large. The contract has a rounding issue in its… <a href="https://t.co/8AdY7pjaKE">pic.twitter.com/8AdY7pjaKE</a></p>— Beosin Alert (@BeosinAlert) <a href="https://twitter.com/BeosinAlert/status/1742389285926678784?ref_src=twsrc%5Etfw">January 3, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>Exploiting this error, the attacker adjusted an index parameter. This tweak caused a sharp inflation and resulted in errors during deposit() and withdraw() operations. This flaw gave the attacker a brief yet significant opportunity to gain substantial profits.</p> 
<p>Also Read: <a href="https://coinpedia.org/news/decembers-crypto-thefts-soar-to-nearly-100m-marking-year-end-surge-in-digital-asset-crimes/">Orbit Bridge Exploit Causes Surge in December Crypto Hack Losses; $100M Recorded!</a></p> 
<h2 class="wp-block-heading" id="h-connecting-the-dots-compound-aave-s-role"><strong>Connecting the Dots: Compound/Aave’s Role</strong></h2> 
<p>PeckShield, an analytics firm, found a connection between this exploit and a vulnerability in the Compound/Aave codebase. Notably, the USDC market was targeted a mere six seconds after its launch. This revelation emphasizes the need for enhanced caution when introducing new markets.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Today's hack on <a href="https://twitter.com/RDNTCapital?ref_src=twsrc%5Etfw">@RDNTCapital</a> results in the loss of 1.9k eth (~$4.5m). <br><br>The root cause is not new: It basically exploits a time window when a new market is activated in a lending market (forked from the popular Compound/Aave). The exploitation also relies on a known rounding… <a href="https://t.co/XogWUVO3po">https://t.co/XogWUVO3po</a> <a href="https://t.co/x5X9ql8AGA">pic.twitter.com/x5X9ql8AGA</a></p>— PeckShield Inc. (@peckshield) <a href="https://twitter.com/peckshield/status/1742334242120466580?ref_src=twsrc%5Etfw">January 2, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<h2 class="wp-block-heading" id="h-radiant-capital-jumps-into-action"><strong>Radiant Capital Jumps into Action</strong></h2> 
<p>In response, Radiant Capital has suspended its Arbitrum activities. The platform assures users that the breach has not compromised additional funds. A thorough investigation is underway, and operations will resume once completed. Radiant Capital, known for its cross-blockchain asset trading, is now closely observed by the crypto community.</p> 
<p><strong>A (Harsh) Lesson for DeFi</strong></p> 
<p>This incident highlights the challenges decentralized finance (DeFi) platforms face in ensuring security. As the crypto world grows, such events emphasize the need for robust defenses against sophisticated attacks. The industry will be keenly watching Radiant Capital’s next steps as it navigates this security breach.</p> 
<p>Also Read: <a href="https://coinpedia.org/research-report/crypto-security-breaches-hacks-of-2023-a-detailed-analysis/">Top Crypto Hacks of 2023: Analyzing the Biggest Crypto Security Breaches – Research Report</a></p>

Radiant Capital Suffers $4.5M Flash Loan Exploit, Suspends Operations

Table of Contents

CoinPedia News

Other articles published on Jan 3, 2024

Justin Sun Allegedly Moved 50Mn USDT to Binance Amid Market Drop

Etherscan Expands Blockchain Data Services with Solscan Acquisition

Ethereum (ETH) Berpotensi Cetak Milyarder Baru di Tahun Ini, Pullix (PLX) Siap Menyaingi

Legal Tech Startup Secures $26 Million in Series B Funding to Propel AI Contract Automation

Additional Interest Rate Increase Signal from FED Member!

UniFirst’s Q1 Earnings: Revenue Tops $589.86M, Guides Up to $2.44B

Join our free newsletter for daily crypto updates!