Compound

Bankroll Network

Onyx

Hundred Finance

Decentralized finance (DeFi) protocol Onyx was exploited for $3.8 million on Sept. 26, according to a report from blockchain security platform PeckShield. The exploit used a known bug in the Compound Finance v2 codebase — one that had already been used to exploit Onyx previously on Nov. 1. A vulnerability in the non-fungible token (NFT) liquidation contract also contributed to the exploit, the report stated.
In a Sept. 27 X post, the Onyx team claimed that the faulty NFT contract was the root cause of the exploit.
According to the PeckShield report, 4.1 million virtual USD (VUSD), 7.35 million Onyxcoin (XCN), 0.23 Wrapped Bitcoin (WBTC), $5,000 worth of the Dai (<a data-ct-non-breakable="null" href="https://cointelegraph.com/dai-price-index" rel="" target="_self" text="null" title="https://cointelegraph.com/dai-price-index">DAI</a>) stablecoin and $50,000 worth of the USDt (<a data-ct-non-breakable="null" href="https://cointelegraph.com/tether-price-index" rel="" target="_self" text="null" title="https://cointelegraph.com/tether-price-index">USDT</a>) stablecoin were drained from the protocol, for a total of over $3.8 million in losses.
<figure>
 <img alt="Onyx protocol exploited a second time for $3.8M via known bug" name="" src="https://s3.cointelegraph.com/uploads/2024-09/019233d8-3e94-74aa-98f3-0ea11cf27659">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/peckshield/status/1839302663680438342" rel="null" target="null" text="null" title="https://x.com/peckshield/status/1839302663680438342">PeckShield</a>
 </figcaption>
</figure>
The known vulnerability exists in version 2 of Compound Finance, which is a codebase often forked and used by decentralized finance protocols. It <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/hundred-finance-loses-7-million-in-optimism-hack" rel="null" target="null" text="null" title="null">led to an exploit</a> against Hundred Finance in April 2023. In October 2023, the vulnerability was used against Onyx for the first time.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/onyx-protocol-exploiter-siphon-2-1-m-loot-tornado-cash" rel="" target="_self" text="null" title="Onyx Protocol exploiter begins siphoning $2.1M loot on Tornado Cash">Onyx Protocol suffers $2.1M Hundred Finance copycat attack</a>
The flaw can only be exploited when an “empty market,” or a market with no liquidity, exists, which generally only happens when a new market is launched.
The Onyx team <a data-ct-non-breakable="null" href="https://x.com/OnyxDAO/status/1839444120060023167" rel="null" target="null" text="null" title="null">acknowledged</a> the exploit in an X post. “Onyx Protocol was subject to a security incident where a nefarious actor exploited the protocol to drain VUSD from the protocol,” it stated. However, it claimed that the known flaw was not its primary cause. “The primary issue wasn’t an empty market but the NFTLiquidation Contract,” it <a data-ct-non-breakable="null" href="https://x.com/OnyxDAO/status/1839444121938706847" rel="null" target="null" text="null" title="null">stated</a> in a thread.
Peck Shield <a data-ct-non-breakable="null" href="https://x.com/peckshield/status/1839307011491770523" rel="null" target="null" text="null" title="null">agreed</a> that the NFT contract was “[a]nother issue that facilitates the hack.” The faulty contract allowed the attacker to “inflate the self-liquidation reward amount” because it didn’t “properly validate (untrusted) user input.”
<figure>
 <img alt="Onyx protocol exploited a second time for $3.8M via known bug" name="" src="https://s3.cointelegraph.com/uploads/2024-09/019233d7-d8f7-7b01-8d5a-97108009666e">
 <figcaption style="text-align: center;">
 Onyx NFT contract vulnerability. Source: PeckShield
 </figcaption>
</figure>
DeFi exploits are a common source of losses for Web3 users. On Sept. 27, liquid staking protocol Bedrock <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/liquid-restaking-protocol-bedrock-suffers-2-million-exploit" rel="null" target="null" text="null" title="null">lost over $2 million</a> due to a vulnerability in its uniBTC contract. On Sept. 23, Bankroll Network was <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/bankroll-attacked-cow-laundering/" rel="null" target="null" text="null" title="null">drained of $230,000</a> when an attacker made multiple self-transfers, exploiting a faulty “buyFor” function to inflate their profits.

Onyx protocol exploited a second time for $3.8M via known bug

Cointelegraph

Other articles published on Sep 27, 2024

Coinpedia Fintech News

Hong Kong to Align Crypto OTC Rules with Europe

Hong Kong to align crypto OTC derivative rules with European standards

Global Market Access for Crypto Investors: The Impact of Qubetics’ Innovative Tokenized Asset Pla...

Arthur Hayes Says It’s Time for a Meme Coin Breakout: These Are His Latest Buys

Harga Bitcoin Diantisipasi Cetak Rekor Baru pada Akhir Oktober 2024

Join our free newsletter for daily crypto updates!