Compound new $100 million exploit

[kryptonick 2659]

We have lost track lately of the attacks on DeFi projects and the last is a big one.

 

An error in Coinbase oracle data was enough to allow an attacker exploit DeFi flagship project Compound (COMP) and liquidate over $100,000,000 worth of collateral, using a flash loan exploit.

Flash loans are performed using code. They are un-collateralized and allow developers to loan instantly and are executed as long as the liquidity is returned with a following transaction or transactions inside the same block.

DAI is a stable coins presumed to be 1:1 pegged to the USD. What happened a few hours ago was this:

 

For four minutes DAI was traded at 1.30 to the USDC on Coinbase exchange, probably because of an error or perhaps manipulation as this small time frame was enough for the attacker to code (or probably had already precoded) and execute a flash loan in one Ethereum block.

The pool attacked was DAI to USDC but the execution required many swaps. I don't understand all of them to be honest because the flash loans are developers tools that require knowledge beyond mine. Etherescan shows what happened if anyone wants to see the sequence of the flash loan execution;

https://etherscan.io/tx/0x53e09adb77d1e3ea593c933a85bd4472371e03da12e3fec853b5bc7fac50f3e4

 

Price of Compound is down a lot today and perhaps it will be affected more because of this incident:

 

 

 

[toprakdere 154]

I accept that the Compound convention hold some genuine guarantee. All things considered, it appears that Compound is one of the uncommon and ongoing occurrences of a completely working DeFi venture comparable to any semblance of Ren's RenVM, which takes into consideration decentralized, secure, and private digital currency trades between blockchains.

Besides, expecting the activity of the Compound convention is really given over to the network, it will ideally have the option to refine the stage into something that will be utilized outside the wall of crypto yield ranchers with a dollar-green thumb.

[Whited35 15285]

Oh darn! The serious problem in DeFi space through the flash loan. Unfortunately, the recognized platform like Coinabse also exhibit the wrong data specially during the high traffic time to the platform. That incident just exhibit, how even the biggest name like Compound could also get suffered from the notorious attacking methods. Clearly, DApp developers should be focused to improve the DeFi platforms' architectures. 

Edited February 18, 2021 by Whited35
Minor error in texts.