Decentralized lending protocol Secured Finance was exploited on Sept. 5, with losses of about $104,000, according to monitoring account Defimon Alerts. The issue stemmed from how collateral was priced: the protocol used the average execution price of the order book within the current block, which allowed an attacker to manipulate that reference through self-trading and have fake borrowing positions recognized as valid collateral.
Defimon Alerts said the attacker deployed a contract first but did not execute right away. The exploit was carried out later using a flash loan and self-trading to push up the valuation before withdrawing USDC. The original attack wallet then failed to complete its first attempt because the transaction reverted due to insufficient gas.
Roughly 48 seconds later, a general-purpose frontrunning bot identified as coffeebabe captured about 0.9 WBTC, worth around $72,000 based on the figures cited in the alert. It then sent about 28.8 ETH to the builder of ultra sound money and kept only about $29 for itself. After that, another bot withdrew part of the remaining USDC.
Decentralized lending protocol Secured Finance suffered an exploit on Sept. 5, with losses of about $104,000, according to Defimon Alerts.
Collateral pricing model opened the door
The root cause, Defimon Alerts said, was the way the protocol priced collateral. Secured Finance valued collateral using the average execution price from the order book within the same block. That allowed an attacker to move the price through self-trading and have fake borrowing positions treated as valid collateral.
Flash loan and self-trading were used before USDC was withdrawn
Defimon Alerts said the attacker deployed a contract at first but did not execute immediately. The attacker later used a flash loan and self-trading to push up the pricing reference and then withdrew USDC.
Failed first attempt was followed by bot intervention
The original attack wallet failed on its first attempt because the transaction reverted due to insufficient gas. About 48 seconds later, a general-purpose frontrunning bot known as coffeebabe took about 0.9 WBTC, or roughly $72,000 based on the figures cited in the alert. It then transferred about 28.8 ETH to the builder of ultra sound money and kept only about $29.
Another bot later withdrew part of the USDC as well.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
