The Onyx decentralized finance platform suffered a security breach that cost over $2.1 million. The exploit exploited a platform codebase accuracy degradation vulnerability called a “rounding error.” PeckShieldAlert cybersecurity experts ere the first to report this breach and later explained the breach as well.
Hi @OnyxProtocol, you may want to take a look:https://t.co/eQAir1T1nh
— PeckShield Inc. (@peckshield) November 1, 2023
Flash Loan Attack on Onyx oPEPE Market Raises Security Concerns
The Onyx oPEPE market, launched five days earlier and lacking liquidity, was attacked. When this market was uncontested, the culprit strategically contributed to obtain access to funds from other markets with surplus liquidity. After that, they used a common rounding error to retrieve the donations.
The hack used a flash loan, which lets users temporarily borrow large amounts of Bitcoin for various tasks. The criminal borrowed a lot of ETH, exchanged it for PEPE tokens, and added them to a pool. By manipulating the exchange rate, the perpetrator exploited precision loss to withdraw more of the underlying asset while burning fewer shares.
Matthew Jiang, BlockSec’s security manager, said the culprit made a large ETH flash loan. The attacker then swapped ETH for PEPE and contributed it to a pool to manipulate the exchange rate. Due to accuracy loss, the attacker burned fewer shares but removed more of the underlying value.
Onyx DeFi Bolsters Security Measures After $1.25 Million ETH Transfer to Tornado Cash
The attack on Onyx resembles Hundred Finance’s attack the year before. The hack was caused by a weakness in an earlier version of Compound V2, which is built into Onyx. Onyx is vulnerable to the security issue because it relies on Compound V2.
The attacker sent 700 ETH, worth $1.25 million, to Tornado Cash, a cryptocurrency mixing service. Hackers sometimes use this method to hide the sources and destinations of stolen funds, making criminal activity monitoring more difficult.
Onyx’s security team is working to fix the problem and improve the platform’s security to prevent future incidents. This incident shows that DeFi security and code auditing are still needed to safeguard users and their assets from such hostile exploits. Onyx is working to fix the problem and strengthen its security to prevent future breaches in decentralized finance.