dForcenet, a group of decentralized finance (DeFi) protocols dealing with trading and lending of crypto assets, has been attacked on Optimism and Arbitrum. A blockchain security platform BlockSec was the first to disclose that the DeFi platform was exploited because of the read-only reentrancy through the curve pool.
dForcenet Experiences Exploit on Optimism and Arbitrum
The blockchain security firm added that the price oracle utilized by the lending protocol of dForce can be exploited by the hacker. In addition to this, the security company presented another possibility. As per BlockSec, the hacker can also generate profit by liquidating positions at an unfair price. It added that the loss witnessed by dForcenet on Optimism is a minimum of $1.73 million.
On the other hand, the DeFi protocol has experienced a slump of nearly $1.91 million on Arbitrum. The blockchain security forum, on its official Twitter channel, also noted the addresses of the transactions carried out by the exploiter on both Optimism and Arbitrum. Another blockchain security company called PeckShield additionally disclosed the news about the exploitation.
wstETH/ETH Curve gauge vaults on Arbitrum & Optimism were exploited a few hours ago, and we immediately paused the dForce Vaults – other parts of the protocol remain intact and user funds are SAFE with dForce Lending.
We will come back with a detailed report and remedies soon.
— dForce (@dForcenet) February 10, 2023
In the words of PeckShield, the cumulative amount taken away in the exploit is nearly $3.6 million. The exploiter remained successful in draining dForcenet’s assets on both Optimism and Arbitrum, as Peckshield revealed on Twitter. According to PeckShield, the price of the wstETHCRV-gauge asset of dForcenet was manipulated through reentrancy to carry out the exploit.
As a result of this, the hacker can liquidate several positions with the utilization of the wstETHCRV-gauge in the form of collateral. PeckShield provided more information about the exploit. According to it, the earliest fund was nearly 0.99 ETH that was extracted from “@RailGUN_Project.” After that, it added, the respective amount was transacted to Arbitrum and Optimism via “@SynapseNetwork_.”
PeckShield moved on to assert that the account of the exploiter still contains a significant amount in it. In its words, the respective account comprises a minimum of up to 2.3K ETH tokens in terms of illegally earned gains. This sum equals $3.65 million worth. dForcenet also confirmed that the protocol went through the exploit.
Protocol Says the Consumer Funds Are Safe
It added to have at once stopped the dForce Vaults. The protocol asserted that the consumer funds are secured with the help of dForce Lending. It brought to the front that a detailed report on the incident will be discussed by it shortly.