Arcadia Finance hacker used reentrancy exploit, team demands return of funds

The Arcadia Finance attacker utilized a reentrancy exploit to drain $455,000 from the decentralized concern (DeFi) protocol, according to a July 10 post-mortem study issued by the app’s improvement team. A “reentrancy exploit” is simply a bug that allows an attacker to “re-enter” a declaration oregon interrupt it during a multi-step process, preventing the process from being completed correctly.

The squad has sent a connection to the attacker demanding the instrumentality of funds wrong 24 hours and threatening constabulary enactment if they neglect to comply.

Post Mortem of ongoing situation, providing a method overview and sharing much accusation connected adjacent steps.https://t.co/NPNbbSzKBQ

— Arcadia Finance (@ArcadiaFi) July 10, 2023

Arcadia Finance was exploited connected the greeting of July 10 and drained of $455,000 worthy of crypto. A preliminary study from blockchain information steadfast Peckshield stated that the attacker had utilized a “lack of untrusted input validation” successful the app’s contracts to drain the funds. The Arcadia squad had denied this, stating that Peckshield’s investigation was mistaken. However, the squad did not explicate what they thought the origin was astatine the time.

The caller Arcadia study stated that the app’s "liquidateVault()" relation did not incorporate a reentrancy check. This allowed the attacker to telephone the relation earlier a wellness cheque had been completed but aft the attacker had withdrawn funds. As a result, the attacker could get funds and not wage them back, draining them from the protocol.

The squad has present paused the contracts and is moving connected a spot to adjacent the loophole.

The attacker archetypal took a flash indebtedness from Aave for $20,672 worthy of US Dollar Coin (USDC) and deposited it into an Arcadia vault. Next, they utilized this vault collateral to get $103,210 USDC from an Arcadia liquidity pool. This was accomplished done a "doActionWithLeverage()" relation that allows users to get funds lone if their relationship tin stay steadfast by the extremity of the block.

The attacker deposited the $103,210 into the vault, bringing the full funds to $123,882. They past withdrew each funds, leaving the vault with nary assets and $103,210 successful debt.

Theoretically, this should person caused each actions to revert, arsenic withdrawing the funds should person caused the relationship to neglect a wellness check. However, the attacker utilized a malicious declaration to telephone liquidateVault() earlier the wellness cheque could commence. The vault was liquidated, eliminating each of its debts. As a result, it was near with zero assets and zero liabilities, allowing it to walk the wellness check.

Since the relationship passed the wellness cheque aft each transactions were concluded, nary of the transactions reverted, and the excavation was drained of $103,210. The attacker paid backmost the indebtedness from Aave wrong the aforesaid block. They repeated this exploit aggregate times, draining a full of $455,000 from pools connected Optimism and Ethereum.

In its report, Arcadia's squad pushed backmost against claims that the exploit was caused by untrusted input, stating that this alleged vulnerability was not “the halfway issue” successful the attack.

Related: Circle, Tether freezes implicit $65M successful assets transferred from Multichain

The Arcadia squad posted a connection to the attacker utilizing the input information tract of an Optimism transaction, stating:

“We recognize you are progressive with Arcadia Finance’s exploit. We're actively moving with information experts and instrumentality enforcement. Your TC deposits and withdrawals connected BNB were a spot excessively fast, it's hard to fell your individuality online these days. We volition escalate this with instrumentality enforcement successful lack of immoderate funds being returned wrong the adjacent 24 hours.”

In its report, Arcadia claimed it had recovered immoderate promising leads for tracking down the attacker. “Besides obtaining addresses linked to centralized exchanges, we besides uncovered links to erstwhile exploits of different protocols,” they said. “The squad is investigating some on-chain and off-chain information to the fullest grade and has aggregate leads.”

Exploits and scams person been a continuing occupation successful the DeFi abstraction successful 2023. A July 5 study from Certik stated that implicit $300 cardinal was lost owed to exploits successful the 2nd 4th of the year.