SlowMist said the attack on 42DAO stemmed from an abnormally low BTCB price reported by the Median Oracle, which the attacker used to trigger liquidations through the protocol’s Spotter and Dog modules. According to the security firm, the Spotter module’s "poke" function wrote the faulty price directly into the Vat account because it lacked price deviation checks, maximum drawdown limits, and a minimum price protection mechanism. The Dog module then used that updated spot price to immediately liquidate multiple BTCB vaults through its "bark" function, without any liquidation delay or oracle price validation in place. SlowMist said the attacker was able to profit from arbitrage through that sequence. Foresight News had earlier reported that Balance Coin, or BLC, the native algorithmic stablecoin incubated and used by 42DAO, was hit in the incident. BLC fell 99%, and 42DAO’s losses were about $915,000.
SlowMist said the attack on 42DAO was caused by an abnormally low BTCB price from the Median Oracle, which the attacker used to launch the exploit through the Spotter module’s “poke” function and the Dog module’s “bark” function.
In SlowMist’s analysis, the Spotter module lacked price deviation checks, maximum drawdown limits, and a minimum price protection mechanism. That allowed the abnormal low price to be written directly into the Vat account. The Dog module then used the updated spot price to carry out immediate liquidations of multiple BTCB vaults without any liquidation delay or oracle price validation, allowing the attacker to complete an arbitrage trade.
Foresight News had earlier reported that Balance Coin (BLC), the native algorithmic stablecoin incubated and used by 42DAO, was hit by the attack. BLC plunged 99%, and 42DAO lost about $915,000.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
