The reason for Onyx's attack is known to be a rounding issue in Compound V2.

According to BlockBeats news on November 1st, Onyx was attacked due to a known rounding issue behind the Compound V2 fork version that was exploited by hackers. The hacker used the oPEPE market that was deployed five days ago but had no liquidity, borrowed from other liquid markets through donation, and then redeemed the funds using the rounding issue. It is worth noting that in April of this year, Gnosis' Compound fork project Hundred Finance also suffered a loss of about $7 million due to the same issue.