
Exploiter address: 0x085bdff2c522e8637d4154039db8746bb8642bff



Repeat exploiter address: 0x5083956303a145f70ba9f3d80c5e6cb5ac842706


The Onyx Protocol, a fork of Compound Finance, experienced a significant loss of $2.1 million due to a well-known vulnerability on Tuesday. This vulnerability, also affecting Hundred Finance and Midas Capital, has collectively resulted in over $10 million in losses. Despite warnings from Peckshield, Onyx did not respond officially for nearly three hours, during which the protocol suffered a repeat attack, albeit with lower profit. Several protocols have fallen prey to similar exploits, including Conic, Sturdy, EraLend, and Midas.

The exploit leveraged a known vulnerability in the Compound v2 code, where a rounding error enabled attackers to manipulate empty markets, draining liquidity across the protocol. Onyx's governance had recently approved Proposal 22, adding a lending market for the memecoin PEPE. The "empty market attack" involved a flash loan swapped for PEPE, manipulating prices through minting oPEPE shares and donating PEPE to inflate oPEPE's value as collateral. The attacker then borrowed against overvalued oPEPE, exploiting the rounding error to withdraw funds.

The 1164 ETH ($2.1M) in profits were sent to an intermediary address, with 1140 ETH deposited into Tornado Cash. The remaining 24 ETH went to on-chain panhandlers, prompting messages begging for further funds. Although Onyx Protocol was audited by Certik, the viability of this vulnerability depends on individual market conditions rather than the codebase.

In the aftermath, Onyx proposed a compensation plan to refund victims by selling native tokens from the treasury. However, the plan raises concerns about potential negative impacts on XCN and the misalignment of team incentives, emphasizing the importance of vigilance and security for teams working with forks.




ONYX PROTOCOL


Attacker address (funded via Tornado Cash): 0x46d9b3dfbc163465ca9e306487cba60bc438f5a2

Attack tx: 0xbc08860c…

Victim address: 0x05f016765c6c601fd05a10dba1abe21a04f924a5



On Tuesday night, a Multiverse bot experienced a significant loss of $2 million in what appears to be an instance of crypto-karma. Spreek identified the issue as an unprotected swap function within the bot's code. This incident is reminiscent of a similar occurrence last year when the notorious bot 0xbadc0de suffered losses of $1.5 million.

In the world of Miner Extractable Value (MEV), bots operate on the edge of the principle "code is law." Despite the complexity of the MEV landscape, the exploit was surprisingly simple. The bot's code had an unprotected swap function that anyone could call. Exploiting this, a sandwich attack was executed on the bot through WETH/WBTC trades on Curve, funded by a $50 million flash loan.

BlockSec clarified that the bot was vulnerable due to the lack of access control for a public function (0xf6ebebbb), allowing manipulation of swaps in Curve pools. The loss incurred was approximately $2 million. The attacker abused the flawed function to pump the asset price, such as WETH, and then executed a reverse swap to make a profit.

The sandwiched swaps resulted in a substantial financial hit for the bot, with the attacker's address funded via Tornado Cash and the victim's address suffering the loss. The incident generated fees of $250,000 for the Curve protocol, showcasing the dynamics of large transactions in the DeFi space.

In the realm of decentralized finance, autonomous bots, though controversial, are often considered a necessary element of a permissionless financial system. The ecosystem's key players, including validators who receive lucrative tips, may find themselves willing to tolerate the activities of these Dark Forest predators. As the crypto landscape continues to evolve, the question remains: how long until others fall prey to unforeseen vulnerabilities?




Newsletter