Decentralized lending protocol Secured Finance suffered an attack on September 5, losing approximately $104,000. The exploit exploited a collateral pricing flaw, using self-trading and flash loans to manipulate prices and drain USDC. The initial attack failed due to insufficient gas fees; about 48 seconds later, the front-running bot coffeebabe seized ~0.9 WBTC (~$72,000), transferring part of the ETH to the ultra sound money builder.
Odaily Planet Daily News: The decentralized lending protocol Secured Finance’s lending market was hit on September 5, with losses of about $104,000. The problem came from how collateral was priced: it used the average transaction price from the order book within the block. That let the attacker push the price around through self-trading and get fake loan positions treated as valid collateral.
The attacker deployed the contract first, then waited instead of firing right away. After that, they used flash loans and self-trading to pump the pricing and pull out USDC. The original attack wallet didn’t get the job done because gas fees were too low, so the transaction was rolled back. Then, roughly 48 seconds later, the general-purpose front-running bot coffeebabe grabbed about 0.9 WBTC, worth around $72,000, and sent about 28.8 ETH to the ultra sound money builder, keeping just about $29. Small cut. Later on, another bot withdrew part of the remaining USDC.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
