…Researched and contributed by Henry George.
Hundred Finance, a multichain lending protocol, has been hit by a significant security breach on the Ethereum layer-2 blockchain Optimism.
On April 15, Hundred Finance announced the exploit and reported losses of $7.4 million.
Although the protocol didn’t disclose how the attack was executed, blockchain security firm Certik noted that it was a flash loan attack.
Hundred Finance has contacted the hacker and is working with various security teams on the incident.
The blockchain security firm says that the exchange rate formula was manipulated through Cash value, and large loans were taken out under the manipulated exchange rate.
Flash loan attacks have been used to target DeFi protocols in recent times.
In such attacks, hackers borrow a large amount of funds via a flash loan (a type of uncollateralized loan) from a lending protocol and manipulate the price of an asset on a decentralized finance (DeFi) platform.
In the case of Hundred Finance, the attacker manipulated the exchange rate between ERC-20 tokens and hTOKENS, allowing them to withdraw more tokens than originally deposited.
Certik notes that the attacker manipulated the exchange rate by donating large amounts of WBTC to the hToken contract so that the exchange rate goes up.
Hundred Finance is preparing a postmortem report on the incident.
It is worth noting that this is not the first time that Hundred has been exposed to an exploit.
Almost 12 months ago, the protocol was hit by another exploit on the Gnosis Chain, where the hacker drained all the protocol’s liquidity through a re-entrancy attack, resulting in a loss of over $6 million.
Since then, there have been several other flash loan attacks on DeFi protocols, including Euler Finance ($196 million) and Mango Markets ($46 million).
It is a worrying trend that DeFi protocols continue to be targeted by hackers using flash loan attacks.
As the use of DeFi continues to grow, it is likely that hackers will continue to find new ways to exploit vulnerabilities in the system.
As the magazine article suggests, it is questionable whether crypto projects should negotiate with hackers.
Nevertheless, it is essential that DeFi protocols remain vigilant and take necessary precautions to prevent such attacks from happening.