The fourth flash loan attack this week: Origin released the attack information and called on the hackers to return the funds

Original title: "This week's 4th lightning loan attack incident, Origin Protocol official article reviewing the attack process"

Original source: Origin Protocol 

Original translation: Babbitt

Assets. According to data from coingecko., OUSD has fallen by 85.5% in the past 24 hours and is now at $0.146. Flash loan attacks are undoubtedly the most common and serious security issues in the DeFi field. In the past week, 4 cases have occurred Flash loan attacks, including Value DeFi ($5.4M), Cheese Bank ($3.3M), Akropolis ($2M) and today OUSD ($7M).”

The following is the information released by Origin Protocol co-founder Matthew Liu about this flash loan attack:

< /p>

Origin Protocol's stablecoin OUSD has been hacked and user funds have been lost. We are actively investigating this issue. Please refer to this blog post as the definitive source for updates over the next few days.

Over the past three hours we have spent the last three hours understanding the attack and tracking it from the OUSD vault to the attacker Progress has been made in the flow of funds to the wallet.

We are actively taking steps to recover funds. This includes working with exchanges and other third parties to potentially identify attackers and/or freeze funds from being liquidated.

We have traced the funds and know that the attackers used both Tornado Cash and renBTC to launder and move funds.

The attacker currently has 7,137 ETH and 2.249 million DAI in one of his wallets.

The transaction information of this attack is here (the earliest attack transaction:

https://etherscan.io/tx/0xe1c76241dda7c5fcf19884 54c621142495640e708e3f8377982f55f8cf2a8401).

There is also a summary of information about the attack below:

< br>

· This attack was due to a reentrancy bug in our contract. In fact, unless an attack is launched against us through one of the stablecoins we support, our contract security is not affected by reentrancy vulnerabilities.

·  The attacker exploited a missing validation check (when minting OUSD via multiple stablecoins) to Passing fake "stablecoins" down. This "stablecoin" is then called "transferFrom" by Vault, allowing hackers to attack the contract via a reentrancy attack during the minting process.

·  After funds are transferred from the first large mint to OUSD and before the OUSD supply increases, the attacker is able to Create a rebase event during the minting period. This creates a huge rebase for everyone in the contract, including the attacker. The attacker then also received their first large OUSD mint, giving them a total of more OUSD than the assets the contract had.

·  The attackers withdrew most of the stablecoins from OUSD.

·  They can then proceed to withdraw OUSD after withdrawing and selling as USDT on Uniswap and Sushiswap.

Currently, the loss of funds is approximately $7 million, which includes Origin and our founders and Over $1 million in funds deposited by employees. We will continue to increase our efforts until we determine why this vulnerability was exploited and whether we are able to recover the funds. We are willing to do whatever we can to resolve this issue.

We have disabled deposits in the Vault. We will then publish a detailed transaction analysis report.

In the next few days, we will take exhaustive measures to retrieve the lost user funds before discussing compensation plans for affected OUSD holders. As a reminder, please do not buy OUSD on Uniswap or Sushiswap, as the current price does not reflect the underlying asset of OUSD.

To the hackers: We ask you to do the right thing and return your funds. You've demonstrated excellent hacking skills and we'd love to hire you as a security consultant. If you return 100% of your funds, we guarantee that no further pursuit or legal action will be taken against you. We humbly ask you to consider the hundreds of innocent people you are harming and return your funds.

Finally, we would like to express our gratitude to the wider blockchain community. During these trying times, we have had great support from investors, DeFi engineers, security experts, and more. We are very grateful to the group who can help us further analyze the attack, trace the funds and possibly identify the attackers. Thanks to all our team members.

Original link  

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia