Sturdy Finance Suffers $800K Loss in Ingenious Hack: A Price Oracle Exploitation Saga - Investor Bites

Sturdy Finance Suffers $800K Loss in Ingenious Hack: A Price Oracle Exploitation Saga – Investor Bites

Time Stamp: June 12, 2023 6:20 AM
Sturdy Finance Suffers $800K Loss in Ingenious Hack: A Price Oracle Exploitation Saga - Investor Bites PlatoBlockchain Data Intelligence. Vertical Search. Ai.

SNEAK PEEK

  • Sturdy Finance suffered a reentrancy attack, resulting in a significant loss of funds.
  • The attacker exploited a vulnerability in Sturdy Finance’s price oracle system.
  • Sturdy Finance has taken immediate action to suspend markets and protect user funds.

Sturdy Finance, a well-known decentralized lending protocol, has fallen victim to a clever security breach. According to reports, the attacker exploited a reentrancy vulnerability, pilfering approximately 442 ether – equivalent to roughly $800,000. 

This method, where an attacker manipulates the repeated calling of a function within a single transaction, allows the perpetrator to withdraw more funds than would otherwise be possible illegitimately. Significantly, it set the stage for deeper security exploitation.

A Price Oracle Exploitation

Following the reentrancy attack, the assailant made their move on Sturdy Finance’s price oracle. This essential element in decentralized finance applications provides real-world price data derived from a separate “read-only” smart contract for Sturdy Finance. 

However, it proved to be a soft spot ripe for exploitation. The oracle, designed to ascertain accurate market values of assets within Sturdy Finance’s liquidity pool, was manipulated, resulting in substantial financial loss.

PeckShield, a security firm that closely monitors such activities, confirmed the method. 

The firm stated, “The root cause is due to the typical Balancer’s read-only reentrancy, while the price of B-stETH-STABLE was manipulated.

As a direct result, the attacker drained funds from Sturdy Finance’s coffers.

Sturdy Finance’s Rapid Response to Attack

Sturdy Finance has taken immediate steps in response, suspending all markets to halt further potential losses. The team assured users that all markets had been paused, no additional funds were at risk, and no user actions were currently required. Consequently, users can sigh of relief knowing their funds are not threatened.

Moreover, after the attack, on-chain data revealed the attacker’s attempts to obscure their activity using the Tornado Cash mixer. 

Time Stamp:

More from Investor Bites