Hackers copied Mango Markets attacker’s methods to exploit Lodestar — CertiK

Blockchain safety firm CertiK has shared a autopsy evaluation of the $5.8 million Lodestar Finance exploit that occurred on Dec. 10:

5. The hacker burned just a little over 3 million in GLP, their revenue on this exploit was the stolen funds on Lodestar – minus the GLP they burned.

6. 2.8 Million of the GLP is recoverable, which is price about $2.4 million. We’re going to attain out to the hacker and…

— Lodestar Finance (,) (@LodestarFinance) December 10, 2022

Related articles

Hector Swap: A revolutionary DeFi swap aggregator

2023-04-13

Fantom: Though DeFi-friendly measures show results, FTM remains in limbo

2023-04-11

In an identical occasion, CertiK mentioned that Lodestar Finance hackers “artificially pumped the value of an illiquid collateral asset which they then borrow towards, leaving the protocol with irretrievable debt.”

“Regardless of a few of the losses being doubtlessly recoverable, the protocol is functionally bancrupt proper now, and customers are being urged to not repay any loans they’ve taken out.”

The assault occurred via a vulnerability within the PlutusDAO’s plvGLP token on Lodestar. In keeping with its documentation, Lodestar “makes use of verified, safe Chainlink value feeds for each asset it affords excluding plvGLP.” As an alternative, the change fee of plvGLP to GLP relied on whole belongings divided by whole provide on Lodestar.

As defined by CertiK, the exploiter first funded their pockets with 1,500 Ether (ETH) on Dec. 8 after which took out eight flash loans for a complete of roughly $70 million price of USD Coin (USDC), wrapped Ether (wETH), and Dai (DAI) two days later. This drove the plvGLP/GLP change fee to 1.00:1.83, which meant that the exploiter was in a position to borrow much more belongings from the protocol.

The borrowings shortly consumed all of the liquidity on the platform, main the hacker to switch the funds out of Lodestar and leaving customers with dangerous debt. It’s estimated that the exploiter made a complete of $6.9 million in income via the assault vector.

“Whereas Lodestar is reaching out to the exploiter in an try to barter a bug bounty ex submit facto, the funds are prone to be largely unrecoverable. Within the absence of an insurance coverage fund that may cowl the losses, customers of the platform bear the price of the exploit.”

CertiK warned that the assault “is the results of flaws within the protocol’s design reasonably than a bug in its sensible contract code.” The blockchain safety agency additional highlighted that Lodestar launched with out an audit, and, due to this fact, and not using a third-party overview of its protocol design.