DeFi vulnerability leading to $6.7M exploit ‘not detected’ by auditors

Decentralized U.S. greenback stablecoin protocol Raft claims that regardless of a number of safety audits, the agency nonetheless suffered a safety exploit resulting in the lack of $6.7 million final week.

In response to the venture’s Nov. 13 autopsy report, a number of days prior, a hacker borrowed 6,000 Coinbase-wrapped staked Ether (cbETH) on decentralized finance protocol Aave, transferred the sum to Raft, and minted 6.7 million Raft stablecoin, dubbed “R,” utilizing a sensible contract glitch.

The unauthorized minted funds have been then swapped off the platform by way of liquidity swimming pools on decentralized exchanges Balancer and Uniswap, netting $3.6 million in proceeds. The R stablecoin depegged after the assault. 

In response to the report:

“The first root trigger was a precision calculation challenge when minting share tokens, which enabled the exploiter to acquire further share tokens. The attacker leveraged the amplified index worth to extend the value of their shares.”

The sensible contracts exploited in the course of the incident have been audited by blockchain safety companies Path of Bits and Hats Finance. “Sadly, the vulnerabilities that led to the incident weren’t detected in these audits,” Raft builders wrote.

The venture says that for the reason that Nov. 10 incident it has filed a police report and is at the moment working with centralized exchanges to trace down the movement of the stolen funds. All Raft’s sensible contracts are at the moment suspended, although customers who minted R “retain the power to repay their positions and retrieve their collateral.”

Decentralized stablecoins are minted utilizing customers’ crypto deposits as collateral. Final December, decentralized stablecoin HAY depegged towards the U.S. greenback after a hacker took benefit of a sensible contract glitch and minted 16 million HAY with out correct collateral. The HAY stablecoin has since re-pegged, partly, because of the protocol requiring a collateralization ratio of 152% on the time of exploit as a part of threat administration. 

We’re conscious of a possible safety vulnerability.

We’re at the moment investigating and can present an replace as quickly as we are able to.

— Raft (@raft_fi) November 10, 2023

Associated: September turns into the largest month for crypto exploits in 2023