Strike

Sonne Finance

Million

Optimism

USDC

The post <a href="https://coinpedia.org/news/behind-the-20-million-sonne-finance-hack-unveiling-the-technical-details/" rel="noopener noreferrer nofollow">Behind the $20 Million Sonne Finance Hack; Unveiling the Technical Details</a> appeared first on <a href="https://coinpedia.org" rel="noopener noreferrer nofollow">Coinpedia Fintech News</a>
Staggeringly, a crypto attacker succeeded in the hack on <a href="https://coinpedia.org/news/defi-project-sonne-finance-exploited-for-20-million-on-optimism" target="_blank" rel="noopener noreferrer nofollow">Sonne Finance</a> to conduct a heist using a very complex exploit that drained the company’s assets, bringing in about $20 million to the attacker. The attack played out for a few days, spotting carefully the backdoor of Sonne Finance’s VELO integration with the Optimism network.
<h2 class="wp-block-heading" id="h-the-course-of-the-strike">The Course of the Strike</h2>
The exploit transaction of two days duration started from the date of the attack according to the <a href="https://www.certik.com/resources/blog/sonne-finance-incident-analysis" target="_blank" rel="noopener noreferrer nofollow">detailed analysis </a>released by CertiK. A few days before, Sonne Finance had carried out a unanimous vote to make VELO transactions possible on the Optimism blockchain and finished all the relevant transactions through the multi-sig wallet.&nbsp;
This wallet included a two-day time lock which was designed to provide an added layer of security by causing transactions to be delayed for two days.
With the completion of the two-day counting period, the attacker implemented a “c-factor” to the markets by afternoon. At this crucial step, the Vulnerable attacker transmitted 400,000,001wei VELO (a minuscule part of the VELO token) in order to mint only 2 wei.
<h2 class="wp-block-heading" id="h-exploiting-the-system">Exploiting the System</h2>
The one to get the loan was the newly issued soVELO which borrowed 35,469,150 VELO from the AMM liquidity pool immediately after the overcollateralized VELO was moved to the soVELO contract.&nbsp;
However, this transfer didn’t mint additional soVELO tokens, leading to an imbalance. The total cash money in the system continued to grow while the total quantity soVELO remained at 2 wei.
That is why the attacker successfully borrowed 265 wei of Wrapped Ethereum, with just the collateral as two wei soVeLO. Due to rounding errors in the division calculations, the adversary was able to become the owner of 35,471,603 VELO. He redeemed the number of tokens for only 1 wei of soVELO instead of the 1 VELO that was suggested.&nbsp;&nbsp;
<h2 class="wp-block-heading" id="h-the-drainage-operation">The Drainage Operation</h2>
The attacker had not stopped sufficiently by then.<a href="https://twitter.com/CertiKAlert/status/1790798562864877958" target="_blank" rel="noopener noreferrer nofollow"> The second period</a>, they had used 100 wei of VELO at the same time at soVELO, so that generated another wei of soVELO as a total supply of 2 wei. This way they kept running the system and got assets drained from several sources.&nbsp;
The assets stolen included: 2,352. 96 VELO, 795. 38 WETH, 768,933. 76 USDC. With the emergence of e ish (a USDC coin on top of Ethereum), 162,92 WBTC (Wrapped Bitcoin),&nbsp; 1667. 45 wstETH (wrapped staked ETH),&nbsp; 777k. 566 USD (Tether) and 1,264,790. 21 USDC.
The fact that such small rounding omissions can lead to the hack’s success is a pointer to the need to audit the code effectively and have a robust failsafe in place for digital assets security in decentralized environments.
Also Check Out : <a href="https://coinpedia.org/research-report/q1-2024-crypto-hack-overview-trends-losses-and-recovery-efforts/" rel="noopener noreferrer nofollow">Crypto Hack Report Q1 2024: Trends, Losses, and Recovery Efforts</a>

Behind the $20 Million Sonne Finance Hack; Unveiling the Technical Details

Table of Contents

CoinPedia News

Other articles published on May 16, 2024

Cardano price prediction: Is ADA Ready to Test the Crucial $1 Resistance Level Soon?

Drift Foundation introduces DRIFT token with bonus airdrop

Futures Exchange Giant CME Plans To Kick Off Bitcoin Trading

Eclipse Founder Neel Somani Steps Down as CEO Amid Sexual Misconduct Claims

Magic Eden NFT Marketplace Records $486 Million in Trading Volume; Milei Moneda ($MEDA) Investors...

Floki Inu's Meteoric Rise: What’s Driving the Surge?

Join our free newsletter for daily crypto updates!