DeFi reports another attack, this time the Origin protocol, which is facing losses of $ 7 million
The series of attacks on crypto protocols continues, and Origin was broken. The first who reported this attack was The Block, which announced that the incident took a place late Monday night.
The hacker noticed a re-entry error in Origin’s smart contracts and that allowed him to steal more than $ 7 million.
The attack was sophisticated and the hacker at first robbed the Origin Protocol’s Origin Dollar (OUSD) vault where it depleted most of the stablecoins. This was followed by a classic scenario where he exchanged OUSD for ETH and DAI via Uniswap and SushiSwap. The attacker ended up depositing about $ 7.7 million in the form of 11,804 ETH and 2,249,821 DAI.
The $ 1 million worth of deposits by Origin founders and employees were also stolen.
Matthew Liu, Origin’s co-founder, also commented on the attack.
A reentrancy bug in Origin’s smart contracts made the attack possible. Such bugs can allow attackers to withdraw more funds from a contract than they are eligible for via re-entrancy.
The attacker exploited a missing validation check in mint multiple (when minting OUSD with multiple stablecoins) to pass in a fake ‘stablecoin’ under their control,” said Liu. “This ‘stablecoin’ was then called ‘transferFrom’ on by the vault, allowing the hacker to exploit the contract with a reentrancy attack in the middle of the mint.
The attacker was able to create a rebase event inside the second mint after funds had moved to OUSD from the first large mint, but before the supply of OUSD increased. This created a massive rebase for everyone in the contract, including the attacker. The attacker then also received their first large OUSD mint, giving them in total more OUSD than the contract had assets.
A crypto researcher, with nickname “Frank Topbottom”, was also commenting on the attack, saying that the attacker also used an flash loan of 70,000 ETH from the decentralized exchange dYdX and swapped these ETHs into USDT and DAI on Uniswap. Subsequently, he had rebased Origin’s contract and minted extra OUSD with USDT.
Frank also specified a specific malicious contract that was supposed to have a “transferFrom ()” function.
Read also: The 41-year-old Italian technician turned the airport into an illegal Ethereum mining farm
If you like our articles we would be happy if you give us a like / follow