Onyx Protocol

Quick Summary

Onyx Protocol suffered a flash loan attack, exploiting a rounding issue, leading to a loss of approximately 2,149,772 USD worth
1,161.29 ETH.




Details of the Exploit

Onyx Protocol, a decentralized liquidity protocol, was exploited on November 1, 2023, through a flash loan attack. The attacker
took advantage of a critical vulnerability in CompoundV2 forks, which caused a known rounding issue. To execute the exploit, the
attacker took out a substantial flash loan in ETH, swiftly converting it to PEPE tokens and contributing PEPE tokens to a specific
pool. Due to precision loss, fewer shares were burned, enabling the withdrawal of assets. The exploit resulted in a loss of
approximately 2,149,772 USD worth 1,161.29 ETH. The attacker has already laundered about 1,140 ETH (equivalent to 1.25 million
USD) to the crypto mixing service Tornado Cash.




Block Data Reference

Attacker Addresses:

https://etherscan.io/address/0x085bDfF2C522e8637D4154039Db8746bb8642BfF

https://etherscan.io/address/0x4C9C8661243E9E9a15A35B8873317eb881330c98

https://etherscan.io/address/0x5083956303A145F70Ba9f3D80C5E6CB5AC842706




Malicious Transaction:

https://etherscan.io/tx/0x27a3788d504af542681436bfdecf1823f7a8a691d04309ad33e6d3825e899746




Malicious Contract:

https://etherscan.io/address/0x052Ad2f779c1b557d9637227036CcAAD623fcEAa




TornadoCash Deposit Transactions:

https://etherscan.io/tx/0xf045dff0312d113d560f401b9fde3e126d06e6aef4294cb09170e03bbcffd33e

https://etherscan.io/tx/0x3990b142c882c3b98447736d4f072cd726a1e6fb9de9e7b0619e11edbd675e3c

https://etherscan.io/tx/0x17cc492fa63122df461f3cbc6f763cf1d5e95b71634b6aa4b317e27f0aac2ca4