Conic Finance DeFi protocol loses $3,2 million in an attack
The attacker conducted a flash loan attack by exploiting vulnerabilities in the protocol.
21.07.2023 - 15:30
1560
2 min
0
DeFi protocol Conic Finance suffered an exploit today by a hacker who managed to make off with 1700 ether (over $3.2 million), according to security analysts at BlockSec. Conic is a DeFi protocol designed to allocate funds across the Curve decentralized exchange using the liquidity pools it operates.
The unidentified attacker exploited a reentrancy vulnerability, which subsequently allowed the manipulation of a faulty price oracle that Conic relied on. This enabled them to drain funds, said Matthew Jiang, the director of security services at BlockSec, in an interview with The Block.
Such an attack leverages the ability to repeatedly call a function within a single transaction before the initial function call completes. This mechanism lets the attacker withdraw more funds than they’re entitled to.
In the incident around 6:35 am ET today, the hacker executed a flash loan, borrowing 20,000 staked ether, as evidenced by on-chain data. These funds were routed to Conic so its price oracle, which is sourced from a third-party “read-only” smart contract, could be tampered with — facilitating the reentrancy attack — BlockSec explained. “The flash-loaned stETH was utilized to amplify the profit,” Jiang said.
Keeping its community informed, Conic announced in a Twitter post that the team was “investigating an exploit involving the ETH Omnipool” and promised to share further updates.
After what appears to be a second attack, Curve Finance urged users to remove all funds from Conic Finance Friday afternoon. Conic later shut down all deposits across omnipools.
"Users are still able to withdraw," Conic Finance wrote on Twitter. "We are assessing the situation and will provide updates as soon as we have them."
This material is taken from the website https://www.theblock.co.
Useful material?
Incidents
Roger Ver has been accused of not paying taxes
May 1, 2024
Mining
After the publication of the financial report, the company’s shares added 5%
Apr 30, 2024
Market
The commission had previously warned the developer of potential enforcement actions
Apr 29, 2024
Market
Funds can be seized by law enforcers due to links to illegal activity
Apr 26, 2024
Market
Tether Finance division will be responsible for the issuance and redemption of USDT stablecoins
Apr 18, 2024
Trends
The first project introduced on the platform will be BounceBit (BB)
Apr 18, 2024