4 flash loan attacks in a week, the stablecoin OUSD lost another 7 million US dollars
Editor's Note: This article comes fromBabbitt Information (ID: bitcoin8btc), compiled by: Kyle, published with permission.
Editor's Note: This article comes from
Babbitt Information (ID: bitcoin8btc)
Babbitt Information (ID: bitcoin8btc)
, compiled by: Kyle, published with permission.
"Origin Protocol's stablecoin OUSD was attacked by a flash loan manipulation oracle machine and lost $7 million in encrypted assets. According to data from coingecko., OUSD has fallen by 85.5% in the past 24 hours and is now at $0.146. The flash loan attack is undoubtedly DeFi In the past week, there have been 4 flash loan attacks, including Value DeFi ($5.4 million), Cheese Bank ($3.3 million), Akropolis ($2 million) and today’s OUSD ($7 million)."
Here’s what Origin Protocol co-founder Matthew Liu posted about the flash loan attack:
Origin Protocol's stablecoin OUSD has been hacked and user funds have been lost. We are actively investigating this issue. Please refer to this blog post as the definitive source for updates over the next few days.
Over the past three hours, we have made progress in understanding the attack and tracking the flow of funds from the OUSD vault to the attacker's wallet.
https://etherscan.io/tx/0xe1c76241dda7c5fcf1988454c621142495640e708e3f8377982f55f8cf2a8401）。
We are actively taking steps to recover funds. This includes working with exchanges and other third parties to potentially identify attackers and/or freeze funds from being liquidated.
We have traced the funds and know that the attackers used both Tornado Cash and renBTC to launder and move funds.
Currently, the attacker still has 7,137 ETH and 2.249 million DAI in one of his wallets.
The transaction information of this attack is here (the earliest attack transaction:
There is also a summary of information about the attack below:
This attack was due to a reentrancy bug in our contract. In fact, unless an attack is launched against us through one of the stablecoins we support, our contract security is not affected by reentrancy vulnerabilities.
The attackers exploited a missing validation check (when minting OUSD via multiple stablecoins) to pass fake "stablecoins" under their control. This "stablecoin" is then called "transferFrom" by Vault, allowing hackers to attack the contract via a reentrancy attack during the minting process.
An attacker was able to create a rebase event during the second mint period after funds were transferred to OUSD from the first large mint and before the OUSD supply was increased. This creates a huge rebase for everyone in the contract, including the attacker. The attacker then also received their first large OUSD mint, giving them a total of more OUSD than the assets the contract had.
The attackers withdrew most of the stablecoins from OUSD.
They can then proceed to withdraw OUSD after withdrawing and selling as USDT on Uniswap and Sushiswap.
Currently, the loss of funds is approximately $7 million, including over $1 million deposited by Origin and our founders and employees. We will continue to increase our efforts until we determine why this vulnerability was exploited and whether we are able to recover the funds. We are willing to do whatever we can to resolve this issue.
