Share this text
DeFi protocol Conic Finance reported a lack of 1700 ETH, valued at over $3.2 million. Blockchain safety agency BlockSec has traced this incident to an unidentified hacker exploiting a reentrancy vulnerability early this morning.
Conic promptly alerted its person base by way of Twitter, confirming the exploit involving the ETH Omnipool, launched July 10, and solely affecting ETH swimming pools.
We are at present investigating an exploit involving the ETH Omnipool and can share updates as quickly as they’re obtainable.
— Conic Finance (@ConicFinance) July 21, 2023
Conic Finance, identified for allocating funds by the Curve decentralized alternate utilizing liquidity swimming pools, fell foul of a two-pronged assault involving the vulnerability and manipulation of a value oracle.
In this case, the attacker took out a flash mortgage of 20,000 staked ETH, redirecting it in direction of Conic’s value oracle, facilitating the exploit. The vulnerability was used together with a manipulation of Conic’s value oracle, which obtains its information from a third-party read-only sensible contract.
Hi @ConicFinance Based on the preliminary evaluation from the malicious tx, our preliminary evaluation reveals the basis trigger comes from the brand new CurveLPOracleV2 contract.https://t.co/JmunQImiE5
FWIW, our audit identifies an identical read-only reentrancy situation. However, the identical situation is… https://t.co/lTgYq4Xp49 pic.twitter.com/bXXC7y1OCL
— PeckShield Inc. (@peckshield) July 21, 2023
In a tweet, Conic updated its group: “Update: – We are continuing to investigate the root cause of the exploit and are consulting with relevant parties. – We have disabled ETH Omnipool deposits on the Conic front end.”