Conic Finance, a prominent decentralized finance (DeFi) protocol, has experienced an exploit. As per the reports, the hacker carefully executed the plan of the exploit and remained effective in taking away huge funds. In this respect, the exploiter successfully took away 1700 ETH tokens (equaling more than $3.2 million), as per BlockSec (a blockchain security platform).
Conic Finance Goes through a Security Attack Costing $3.2M in Losses
Conic Finance noticed the respective incident and instantly confirmed the news of the exploit on its official Twitter handle. The platform witnessed that exploit on its Ethereum-based omnipool. Conic is known as a protocol that is structured to devote funds to the decentralized exchange Curve with the use of its liquidity pools.
We are currently investigating an exploit involving the ETH Omnipool and will share updates as soon as they are available.
— Conic Finance (@ConicFinance) July 21, 2023
Up till now, the identity of the hacker has not been discovered. The hacker detected and exploited a vulnerability related to reentrancy. As a result of this, the hacker efficiently manipulated a defective price oracle on which Conic depended. Following that, the exploiter effectively drained a lot of funds, Matthew Jiang (BlockSec’s director of security services) stated in his recent interview.
This type of attack takes benefits from the capability to repeatedly utilize a function within one transfer before the accomplishment of the first use. The respective mechanism enables malicious actors to extract additional funds. As reported by Beosin Alert (a Web3 risk-alert platform), almost the entirety of the whole exploited amount of crypto was delivered to an exclusive address on Ethereum. This was carried out in only one transfer, Beosin added.
The Platform Keeps on Investigating the Matter
Apart from confirming the exploit, Conic Finance also disclosed that the platform is at present investigating the matter. It assured us to provide more updates with time in this regard. As per the first analysis that the blockchain security platform Peckshield provided, the chief reason for the exploit was the latest CurveLPOracleV2 contract. PeckShield also commented on this incident. The platform brought to the front that its audit has detected an analogous read-only reentrancy problem.
Trending Now: Bitcoin Falls Below 100-Hour MA to Trade at About $29,800
Nonetheless, it added, the newly launched CurveLPOracleV2 contract contains the same issue. However, this was not included in the scope of the audit, the platform noted. The exploiter routed the exploited funds to Conic. This activity focused on tempering the platform’s price oracle that originates from a read-only 3rd-party smart contract. As per Jiang, the attacker used the flash-loaned stETH tokens to enhance the profit.