Compound

Onyx

VUSD

CoW Protocol

The Onyx lending and borrowing platform has been exploited for $3.8M. Hacken, the security auditing hub, analyzed the unusual activity on the platform and estimated the nature of the attack.&nbsp;
Onyx Protocol has been affected by an exploit, losing $3.8M. The attack was achieved via a custom-generated malicious contract, deployed just minutes before calling to Onyx. The hacker managed to drain Virtual USD (VUSD), the protocol’s native stablecoin. This is the second hack for Onyx since November 3, 2023, when the <a href="https://defillama.com/protocol/onyx-protocol#information" rel="noopener noreferrer nofollow" target="_blank">TVL</a> of the project also crashed. The exploit led to additional social media attacks, with faked links claiming to safeguard assets. The best approach is to only interact with the official social media of Onyx Protocol.&nbsp;
Onyx announced that VUSD itself is not affected and will continue to function. However, the exploit ended up destroying the stablecoin’s peg, despite the extra collateral. VUSD crashed to a low of $0.39 and did not recover its $1 nominal level immediately.&nbsp;
<figure id="attachment_593073" aria-describedby="caption-attachment-593073" style="width: 100%" class="wp-caption alignnone"><img loading="lazy" decoding="async" class="wp-image-593073 size-full" src="https://www.cryptopolitan.com/wp-content/uploads/2024/09/VUSDSep262024.png" alt="VUSD lost its $1 peg and has not recovered as of September 26, 2024." width="979" height="516" srcset="https://www.cryptopolitan.com/wp-content/uploads/2024/09/VUSDSep262024.png 979w, https://www.cryptopolitan.com/wp-content/uploads/2024/09/VUSDSep262024-300x158.png 300w, https://www.cryptopolitan.com/wp-content/uploads/2024/09/VUSDSep262024-768x405.png 768w" sizes="(max-width: 979px) 100vw, 979px">
 <figcaption id="caption-attachment-593073" class="wp-caption-text">
 Virtual USD (VUSD) lost its $1 peg after the exploit, not recovering despite the collateral. | Source: <a href="https://coinmarketcap.com/currencies/virtual-usd/" rel="noopener noreferrer nofollow" target="_blank">Coinmarketcap</a>
 </figcaption>
</figure>
While the final sum that the hacker managed to withdraw is small, the protocol’s losses may be deeper. The VUSD token has a nominal circulating supply above <a href="https://coinmarketcap.com/currencies/virtual-usd/" rel="noopener noreferrer nofollow" target="_blank">$51M</a>, but its current market capitalization is at $19M.&nbsp;
<h3 id="span-style-font-weight-400-onyx-faced-precision-exploit-of-its-exchange-rate-span">Onyx faced precision exploit of its exchange rate</h3>
One of the reasons for the Onyx exploit was the availability of low-liquidity pools. Analysis by Hacken estimated the exploit was due to an exchange rate miscalculation, when there is low liquidity in some pairs. The hacker prepared a smart contract to swap WETH for Onyx ETH (oETH).&nbsp;
Starting with a 2,000 WETH loan from Balancer, the hacker moved through several crypto assets. At the same time, the malicious contract spammed Onyx with a series of low-value ETH transactions. The result of the swaps and pool transfers netted the hacker with 3.8M VUSD, nominally valued at $3.8M.&nbsp;
The final transaction managed to withdraw 300K VUSD, which were swapped for ETH using CoW Protocol split trades. The transactions caused some slippage and the VUSD price was lower than the $1 nominal, so one of the outgoing transactions was for <a href="https://etherscan.io/tx/0x46567c731c4f4f7e27c4ce591f0aebdeb2d9ae1038237a0134de7b13e63d8729" rel="noopener noreferrer nofollow" target="_blank">$191K</a>.&nbsp;
<h3 id="span-style-font-weight-400-other-assets-from-onyx-also-affected-span">Other assets from Onyx also affected</h3>
The series of attacks against Onyx pools affected several assets. Peckshield identified transfers of 4.1m VUSD, 7.35m Onyxcoin (XCN), 5k DAI, 0.23 WBTC, 50k USDT. All of the transfers happened in one transaction, carried out by the malicious smart contract.&nbsp;
<figure id="attachment_593072" aria-describedby="caption-attachment-593072" style="width: 100%" class="wp-caption alignnone"><img loading="lazy" decoding="async" class="wp-image-593072 size-full" src="https://www.cryptopolitan.com/wp-content/uploads/2024/09/OnyxSEp262024.png" alt="" width="915" height="329" srcset="https://www.cryptopolitan.com/wp-content/uploads/2024/09/OnyxSEp262024.png 915w, https://www.cryptopolitan.com/wp-content/uploads/2024/09/OnyxSEp262024-300x108.png 300w, https://www.cryptopolitan.com/wp-content/uploads/2024/09/OnyxSEp262024-768x276.png 768w" sizes="(max-width: 915px) 100vw, 915px">
 <figcaption id="caption-attachment-593072" class="wp-caption-text">
 The hacker also took away multiple tokens: WETH, XCN, DAI, WBTC, and USDT. | Source: <a href="https://etherscan.io/tx/0x46567c731c4f4f7e27c4ce591f0aebdeb2d9ae1038237a0134de7b13e63d8729" rel="noopener noreferrer nofollow" target="_blank">Etherscan</a>
 </figcaption>
</figure>
Onyx is a Compound V2 hard fork, carrying all the flaws of the protocol. Onyx itself has been hacked before in a similar way, exploiting value calculations and the exchange rate on illiquid pairs.&nbsp;
<a href="https://medium.com/coinmonks/sonne-finance-exploit-tracing-the-20-million-lost-to-the-hack-79140bbc3e7d" rel="noopener noreferrer nofollow" target="_blank">Sonne Protocol</a> was exploited in May, again due to known flaws on Compound V2, which affected all forked projects and have not been repaired. The flaw is seen whenever the protocol initiates new, unfunded markets. The introduction of new pairs in a dynamic DeFi space has multiplied the problem, leading to several hacks.&nbsp;
Due to the miscalculation, the hacker could call the protocol’s smart contract and receive much bigger loans in exchange for negligible collateral.&nbsp;
The current Onyx attack has a similar structure to the Sonne Protocol hack, again withdrawing a substantial amount of tokens for minimal collateral. The long series of 56 spam transactions whittled away at the Onyx exchange rate, again allowing the hacker to withdraw all funds for a tiny collateral.&nbsp;
So far, no NFTs have been affected. Onyx Protocol hosts Bored Ape (BAYC) and Mutated Ape (MAYC) NFT for up to 37% annualized passive income. PeckShield also detected a flaw with the project’s <a href="https://x.com/peckshield/status/1839307011491770523" rel="noopener noreferrer nofollow" target="_blank">NFT contract</a>, though this has not led to an additional exploit.
<h3 id="span-style-font-weight-400-the-attack-may-be-the-work-of-a-rogue-employee-span">The attack may be the work of a rogue employee</h3>
The Onyx protocol attack is relatively small, even compared to individual wallet attacks. The effect on the value of VUSD and other assets may be bigger. But the attack may be exposing another serious threat to crypto projects – rogue employees.&nbsp;
The Onyx protocol exploit may be due to a <a href="https://www-cryptopolitan-com.webpkgcache.com/doc/-/s/www.cryptopolitan.com/north-korea-crypto-devs-make-500k-zachxbt/" rel="noopener noreferrer nofollow">North Korean hacker</a> posing as a project developer. Researchers claim they have contacted the Onyx team with potential evidence of ties to DRPK hackers.&nbsp;
On the other hand, the Compound V2 vulnerability is well-known, and may not have required insider knowledge to exploit.&nbsp;
Cryptopolitan reporting by Hristina Vasileva

Onyx protocol hacked again for $3.8M through exchange rate exploit

Table of Contents

Cryptopolitan_News

Other articles published on Sep 26, 2024

Cardano Flexes Its Muscles: 8 Transactions, 1600 Recipients at Just $2.38 Fees

Polymarket Considering Token Launch Amidst New $50M Fundraising Talks: Report

Year-to-Date Crypto Winners: Who Leads the Pack in 2024?

$1.28 Billion Market Crash: Who Sold Bitcoin (BTC)?

SphereX Launches Mainnet, Introduces Reward System for Traders and Users

MicroStrategy Acquires 7,420 More Bitcoin, Bringing Total Holdings to 252,220 BTC

Join our free newsletter for daily crypto updates!