Sturdy Finance, a financial protocol, made the decision to temporarily pause its markets on June 12 following an exploit that resulted in estimated losses of approximately 442 ETH, equivalent to $800,000, according to blockchain security firm Peckshield.
The Sturdy Finance team confirmed awareness of the exploit and assured users that no additional funds were at risk, with further updates pending the completion of the investigation.
Exploit Analysis by Blockchain Security Firms:
Peckshield, one of the leading blockchain security firms, initially reported that the exploit on Sturdy Finance was connected to a faulty price oracle.
Subsequent analysis revealed that the root cause of the vulnerability stemmed from the defective price oracle responsible for computing the cB-stETH-STABLE asset price.
0xScope, a Web3 knowledge graph protocol, corroborated this finding and further revealed that the hacker transferred the stolen funds to the crypto-mixing protocol Tornado Cash and the Change Now exchange.
Smart contract auditor BlockSec also weighed in on the exploit, highlighting not only the price oracle manipulation mentioned by Peckshield and 0xScope but also signs of a “typical Balancer’s read-only reentrancy” attack.
BlockSec explained that the attacker executed a flash loan from Aave, borrowing over 100,000 staked Ethereum, before exploiting a liquidity pool managed by the Sturdy Finance team on the Balancer platform.
Understanding the Reentrancy Attack:
CertiK, another respected blockchain security firm, provided insights into the nature of a reentrancy attack. This type of attack allows an attacker to drain funds from a vulnerable contract by repeatedly calling the withdraw function before the contract has a chance to update its balance.
In the case of Sturdy Finance, the exploit involved manipulating the balance and taking advantage of the reentrancy vulnerability in the protocol.
