The sentiment team has confirmed the attack, paused the main contract and implemented a fix for the vulnerability with the help of external security auditors.
Hacker exploited Re-Entrance vulnerability
The Sentiment liquidity log on the Arbitrum blockchain was hacked on April 4 for nearly $1 million in various tokens including wrapped Bitcoin and Ether.
Sentiment team members confirmed the attack and confirmed unusual borrowing activity identified as a malicious exploit. To deal with the situation, the team paused the main contract and disabled all features except withdrawals.
1/4
A status update on the current situation: At around 18:00:00 + UTC, the sentiment team became aware of unusual borrowing activity, which has now been declared a malicious exploit.
— Sentiment (@sentimentxyz) April 5, 2023
Possible cause of the attack
The attacker apparently stole the tokens via a re-entry vulnerability and then switched to the Ethereum chain. As CertiK points out, the fundamental reason is Balancer’s read-only re-entry.
The price oracle used to determine the price is based on the asset balances in the pool and the total amount of LP tokens. As reported, by using the Balancer vault’s “JoinPool” feature, the exploit increased the total supply of the LP coin by 606 WBTC, 10,000 WETH, and 18 million USDC. The funds were then withdrawn using exitPool(), sending 606.8 WBTC, 1,000 ETH, and 17.9 million USDC in sequence.
A fallback function reduces demand, but the pool balances of WBTC, WETH and USDC remain the same, so the price is skewed, allowing the attacker to borrow many assets at the skewed price.
Sentiment is now investigating the protocol’s stolen cash. Additionally, the team works with law enforcement to identify the hacker and recover the funds.
Working with third-party security auditors, the sentiment team released a fix that addresses the vulnerability and allows users to repay debts and liquidate their positions.
Sentiment also messaged the hacker and offered to keep 10% of the stolen funds as a bounty if they returned the rest. In the letter, the company promised a payment of $95,000 if the assets were returned before 8am UTC on April 6th.
If the prize is not returned, Sentiment distributes it to those who provide information about the hacker. The liquidity protocol on Arbitrum was previously audited by two crypto security firms.
Sentiment has a total locked volume (TVL) of $5.8 million compared to $10.76 million on April 4th.
What is Mood:
Sentiment is a liquidity protocol that enables on-chain, approval-free, undercollateralised borrowing. This protocol aims to address capital inefficiencies in DeFi by offering a primitive-based solution for permissionless, undercollateralized on-chain lending. By implementing onchain mortgage, Sentiment mitigates the challenge of widespread counterparty risk.
Learn more about Mood:
Website | Twitter | discord
Learn Crypto Trading, Yield Farms, Income strategies and more at CrytoAnswers
https://nov.link/cryptoanswers
Comments are closed.