DeFi protocols just lost $83 million to an attack financial regulators already warned about
Malicious actors uncovered two decentralized finance (DeFi) lenders to over $84 million in losses over 4 days, utilizing variations of a price-manipulation technique beforehand focused by US regulators.
The bigger incident hit Tectonic on the Cronos blockchain, the place safety agency GoPlus estimated roughly $75 million was affected.
Three days earlier, Moonwell’s MAMO lending market on Base was left with about $9.1 million in residual debt following one other attack involving an illiquid token.
Illiquidity turns into a weapon
The Tectonic attacker seems to have exploited the protocol’s remedy of TONIC, a comparatively thinly traded token that may very well be deposited as collateral and used to assist borrowing.
GoPlus described the incident as a price-manipulation and over-borrow attack through which the attacker repeatedly looped collateral and borrowing positions whereas pushing TONIC sharply greater inside minutes.
Tectonic assigned TONIC a collateral issue of about 20%, that means each $100 of collateral acknowledged by the protocol may assist roughly $20 in borrowing.
As TONIC’s market value climbed, the worth assigned to the attacker’s place elevated robotically. GoPlus estimated that the manipulated holdings finally represented about $375 million in collateral worth, translating into roughly $75 million of potential borrowing capability.
The attacker then used that expanded credit score line to withdraw USDT and different liquid belongings.
The commerce exploited a elementary imbalance. A token buying and selling in a shallow market can typically be moved considerably with comparatively little capital, whereas lending contracts might use that elevated value to calculate borrowing limits in opposition to swimming pools holding considerably extra priceless belongings.
Once the shopping for strain disappears and the manipulated token falls, the collateral backing these loans could be price considerably lower than the belongings already withdrawn.
Cronos halted block manufacturing to comprise the incident, although about $6 million had already been bridged to Ethereum and swapped into roughly 2,600 ETH. The halt prevented the remaining affected belongings from shifting throughout the community.
As of Monday morning, Cronos said the blockchain remained halted whereas it investigated the Tectonic exploit with help from safety groups throughout the trade. The community has not disclosed when operations will resume, whereas Tectonic has but to publish a closing accounting of the losses.
Notably, Moonwell confronted a associated drawback solely three days earlier.
The Aug. 27 attack focused its MAMO market on Base. The attacker started with about $1.95 million in USDC and accrued greater than 94 million MAMO tokens.
The attacker then transferred about 53 million MAMO instantly into Moonwell’s mMAMO collateral contract with out minting further shares. That maneuver elevated the quantity of underlying MAMO represented by every current share by roughly 3.7 instances.
At the identical time, MAMO’s market value surged from about $0.0106 to $0.4313.
Those two actions sharply elevated the worth Moonwell acknowledged for the attacker’s collateral. The attacker subsequently accomplished 18 borrows totaling roughly $11 million in cbBTC, WETH, USDC, and wstETH.
Liquidations started just 32 seconds after the ultimate borrow, however Moonwell was left with about $9.1 million in residual borrower obligations. Security agency SlowMist individually estimated losses at roughly $8.7 million and recognized reliance on pricing from a skinny MAMO market as the basis vulnerability.
Echoes of Mango Markets
While the mechanics of the 2 assaults weren’t equivalent, they adopted a broader technique of utilizing an illiquid asset to manufacture collateral worth, then convert that inflated valuation into borrowing energy in opposition to deeper swimming pools of capital in DeFi methods.
The most outstanding precedent got here in October 2022 with Mango Markets.
Avraham Eisenberg constructed positions linked to MNGO earlier than aggressively shopping for the thinly traded token on exchanges feeding costs into the platform. MNGO’s reported worth rose greater than 13-fold in about half-hour.
Eisenberg then used the inflated worth of these positions as collateral to withdraw greater than $110 million in digital belongings from Mango Markets.
US regulators pursued the conduct in early 2023. The Commodity Futures Trading Commission (CFTC) described the operation as a “manipulative and misleading scheme” and stated the case was its first involving a technique generally referred to as oracle manipulation on a decentralized digital-asset platform.
The Securities and Exchange Commission (SEC) filed a parallel motion, alleging Eisenberg artificially elevated MNGO’s value and used the ensuing collateral valuation to borrow and withdraw about $116 million.
More than three years after these enforcement actions, Tectonic and Moonwell present that variations of the identical financial attack stay viable.
The recurring weak point lies in lending methods that permit thinly traded belongings to assist borrowing limits far larger than the liquidity required to transfer their costs.
When these limits alter robotically as collateral costs rise, a manipulated market can rapidly develop into a gateway into a lot bigger swimming pools of liquid belongings.
The submit DeFi protocols just lost $83 million to an attack financial regulators already warned about appeared first on CryptoSlate.
