Polygon-based DeFi protocol 0VIX has fallen victim to the latest flash loan attempt in the cryptocurrency market. Besides the $2 million loss, the price of Aavegotchi’s native token was also manipulated.
$2 million flash loan attack on this cryptocurrency platform
0VIX, a lending protocol on Polygon and Polygon zkEVM, reported losses of approximately $2 million as a result of a flash loan attack. The exploit took place via the vGHST token. Before exploiting the vulnerability, the total locked value of the protocol was $6.4 million. That figure is now down to $1.7 million as investors quickly withdraw their capital.
Officer’s Notes, an independent security researcher, said that the attackers transferred $1.4 million in USDC and $600,000 in USDT through the briding protocol Stargate Finance while attempting to transfer funds back to Ethereum and convert stablecoins to ETH. The 0VIX team has decided to temporarily halt the lending markets while investigating the matter.
0VIX is working with its security partners to look into the current situation that seems to be related to vGHST.
As a result, POS and zkEVM markets have been paused this includes pausing oToken transfers, minting, and liquidations.
Only POS has been currently affected but zkEVM…
— 0VIX | live on zkEVM (@0vixProtocol) April 28, 2023
After the attack, 0VIX said, “0VIX is working with security partners to look into what appears to be vGHST-related. As a result, we paused the POS and zkEVM markets. This includes pausing oToken transfers, printing and liquidations. Currently only POS is enabled. But we paused zkEVM as a precaution. We will probably be reactivated shortly.”
autopsy report
PeckShield reports that the attackers received a $6.12 million flash loan in stablecoins to manipulate the vGSHT lending pool at 0VIX.
Another blockchain security firm, Blocksec, confirmed that hackers used borrowed stablecoins to open vGSHT lending positions, and then the protocol manipulated price oracle contracts.
GHST price manipulated: rally 30%
As the chart below shows, Aavegotchi’s token GHST rose by double digits in less than 30 minutes. The price increase reached over 25% at one point. Moving sideways throughout the day, GHST quickly peaked from $1.13 to $1.41. The price is currently trading lower from the start.
What is a flash loan?
Such attacks are called price oracle manipulation attacks, which are common in DeFi circles. Attackers inflate the price of a low-liquid token like GHST by manipulating oracle contracts. It then replaces the pumped coins with other coins with ample liquidity and stable price.
cryptocoin.com As we reported, Mango Markets in Solana and bZx exchange on Ethereum and BNB Chain were hacked with the same technique. Cryptocurrency platforms lost $100 million and $55 million, respectively.
