DeFi Hackers Bag More Millions in Another Flash Loan Attack

Hackers have drained another DeFi lending protocol of millions thanks to a buggy smart contract and flash loans.

by Nivesh Rustgi | Powered by Gloria

Dec. 18, 2020

Another flash loan attack has drained all of Warp Finance’s liquidity, costing liquidity providers (LPs) $7.7 million.

The developer team does, however, have a chance of recovering some of the funds.

DeFi Suffers Flash Loan Attack, Again

Warp Finance, a lending platform that grants stablecoins loans for collateral in cryptocurrencies, suffered a flash loan attack, costing users $7.7 million.

The attacker took a double flash loan from DyDx and used three Uniswap pools to exploit Warp Finance.

Warp Finance had implemented a faulty oracle implementation, which allowed the hacker to obtain Ethereum at $141.9 apiece. Ethereum is currently trading at $648.52.

The last swap before the DyDx loan repayment involved $48.5 million DAI for 342,252 ETH (worth $222 million).

Transaction details of the hack. Source: Etherscan

Nevertheless, a significant portion of the amount—$5.5 million—still hasn’t reached the hands of the hacker. Code in the smart contract has locked funds, preventing them from withdrawal.

There is a possibility that Warp Finance developers can override the contract to recover the remaining funds. The chances of this are, however, very slim.