Onyx, a fork of DeFi lending protocol Compound Finance, was hit with a $3.2 million on Thursday, marking the second time the protocol’s smart contract was exploited over the past year.
According to security firm Fuzzland, a malicious contract was deployed to Onyx at 11:57 a.m., approximately five minutes before the attack occurred. Rival security firms PeckShield and Cyvers also noticed suspicious transactions on OnyxDAO, prior to the hack.
Cyvers noted most of the losses were in VUSD, a U.S. dollar-denominated stablecoin. The suspected attacker also holds 521 ETH worth about $1.36 million and, according to Cyvers, has hesitated to swap the stolen assets.
According to PeckShield, which pins the loss at closer to $3.8 million, the attacker attacked a known bug in the forked Compound V2 code base and was able to siphon VUSD, DAI and tether stablecoins, among other cryptocurrencies.
“Another issue that facilitates the hack is related to the NFTLiquidation contract, which does not properly validate (untrusted) user input and was exploited to inflate the self-liquidation reward amount,” Peckshield wrote on X.
Last October, Onyx suffered a $2.1 million attack exploiting an integer rounding vulnerability and a flash loan attack.
"Last year was due to a vulnerability introduced when they forked compromised Compound code. This time they introduced a vulnerability themselves via errors in their logic," Fuzzland founder Chaofan Shou told The Block in a message.
Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.
© 2024 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
