A hacker got over 44 RBTCs on a Bitcoin-based finance protocol and escaped. He executed the transaction using a price manipulation technique in one of the protocol’s lending pools. Here are the details…
Price manipulation in Bitcoin-based protocol
Sovryn, a Bitcoin-based decentralized finance protocol, faced a price manipulation on Tuesday. On top of that, over $1 million of funds were emptied. The attack resulted in the hacker stealing over $1 million in crypto from the protocol, including 44.93 RBTC and 211,045 USDT. According to Sovryn’s blog post on the subject, the attacks specifically targeted the legacy Sovryn Borrow/Lend protocol. RBTC and USDT impacted loan pools. Sovryn explained that user funds were not affected by the attack. Any missing value in the lending pools will be re-injected by the Exchequer, the Sovryn treasure.
RBTC and USDT are cryptocurrencies pegged to Bitcoin and the US dollar, respectively. In this case, the coins are circulating on Rootstock (RSK), a Bitcoin sidechain that aims to expand Bitcoin’s smart contract, dapp, and scaling capabilities. Sovryn is a Defi protocol built on RSK. It seems that some of the funds are being withdrawn using Sovryn’s automatic market maker (AMM) function. This means that the attacker has seized several different tokens. Efforts to recover funds are still ongoing.
How did the hack happen?
According to Sovryn’s post, they noticed the attack thanks to the multi-layered security approach taken. They stated that the attacker was spotted trying to withdraw the funds. At this point, with a concerted effort, the developers were able to recover about half of the value lost by the attack. Sovryn spokesman Edan Yago said it was the first “successful” attack against protocol after two years of operation. He claimed that Sovryn is “one of the most heavily audited DeFi systems” with “bug bounty” with valuable and active bug bounties.
The hacking took place through Sovryn’s manipulation of the iToken price. These tokens represent a user’s share of cryptocurrency in the lending pool and provide interest. The price of this token is updated each time it interacts with the lending pool. First, the attacker bought WRBTC (wrapped RBTC) using a flash transaction on RskSwap. Then he used his own XUSD (another stablecoin) as collateral. Borrowed additional WRBTC from Sovryn’s lending contract. Sovryn’s post included the following statements:
The attacker then provided liquidity to the RBTC loan contract. He closed his loan with a transaction using XUSD collateral, used iRBTC tokens. Flash sent WRBTC back to RskSwap to complete the transaction.
Contact us to be instantly informed about the last minute developments. twitter‘in, Facebookin and InstagramFollow and Telegram and YouTube join our channel!
Risk Disclosure: The articles and articles on Kriptokoin.com do not constitute investment advice. Bitcoin and cryptocurrencies are high-risk assets, and you should do your due diligence and do your own research before investing in these currencies. You can lose some or all of your money by investing in Bitcoin and cryptocurrencies. Remember that your transfers and transactions are at your own risk and any losses that may occur are your responsibility. Cryptokoin.com does not recommend buying or selling any cryptocurrencies or digital assets, nor is Kriptokoin.com an investment advisor. For this reason, Kriptokoin.com and the authors of the articles on the site cannot be held responsible for your investment decisions. Readers should do their own research before taking any action regarding the company, assets or services in this article.
Disclaimer: Advertisements on Kriptokoin.com are carried out through third-party advertising channels. In addition, Kriptokoin.com also includes sponsored articles and press releases on its site. For this reason, advertising links directed from Kriptokoin.com are on the site completely independent of Kriptokoin.com’s approval, and visits and pop-ups directed by advertising links are the responsibility of the user. The advertisements on Kriptokoin.com and the pages directed by the links in the sponsored articles do not bind Kriptokoin.com in any way.
Warning: Citing the news content of Kriptokoin.com and quoting by giving a link is subject to the permission of Kriptokoin.com. No content on the site can be copied, reproduced or published on any platform without permission. Legal action will be taken against those who use the code, design, text, graphics and all other content of Kriptokoin.com in violation of intellectual property law and relevant legislation.