$800K lost following Sturdy Finance security breach

June 12, 2023 06:59 PM AEST | By Invezz

$800K lost following Sturdy Finance security breach — Image source: Invezz

How the Study Finance attack was orchestrated

Reentrancy attacks, which are frequently used to fraudulently withdraw money from DeFi protocols, were used to launch the attack on Sturdy Finance. This kind of attack makes use of the capability to make multiple calls to the same function within a single transaction before the initial function call has finished. The attacker was able to withdraw more money than they were legally allowed to by taking advantage of this flaw.

The attacker then used their control over the function calls to take advantage of the price oracle. Sturdy Finance derived its price oracle from a separate “read-only” smart contract, which was in charge of accurately estimating the market value of assets in a liquidity pool run by the Balancer protocol. The attacker, however, was successful in manipulating the oracle, allowing them to steal funds from Study Finance.

Security Company BlockSec identified the root cause of the breach as the typical reentrancy vulnerability in Balancer’s system, combined with the manipulation of the price of B-stETH-STABLE.

According to on-chain data, the attacker then went ahead to use the embattled Tornado Cash mixer to obfuscate their activities.

Sturdy Finance responded to the attack right away by suspending all of its markets in order to limit potential losses. Users received assurances from the team that no additional funds were in danger and that no immediate action was needed on their part. They promised to share more details as soon as they were made available.

The post $800K lost following Sturdy Finance security breach appeared first on Invezz.

Disclaimer

The content, including but not limited to any articles, news, quotes, information, data, text, reports, ratings, opinions, images, photos, graphics, graphs, charts, animations and video (Content) is a service of Kalkine Media Pty Ltd (Kalkine Media, we or us), ACN 629 651 672 and is available for personal and non-commercial use only. The principal purpose of the Content is to educate and inform. The Content does not contain or imply any recommendation or opinion intended to influence your financial decisions and must not be relied upon by you as such. Some of the Content on this website may be sponsored/non-sponsored, as applicable, but is NOT a solicitation or recommendation to buy, sell or hold the stocks of the company(s) or engage in any investment activity under discussion. Kalkine Media is neither licensed nor qualified to provide investment advice through this platform. Users should make their own enquiries about any investments and Kalkine Media strongly suggests the users to seek advice from a financial adviser, stockbroker or other professional (including taxation and legal advice), as necessary. Kalkine Media hereby disclaims any and all the liabilities to any user for any direct, indirect, implied, punitive, special, incidental or other consequential damages arising from any use of the Content on this website, which is provided without warranties. The views expressed in the Content by the guests, if any, are their own and do not necessarily represent the views or opinions of Kalkine Media. Some of the images/music that may be used on this website are copyright to their respective owner(s). Kalkine Media does not claim ownership of any of the pictures displayed/music used on this website unless stated otherwise. The images/music that may be used on this website are taken from various sources on the internet, including paid subscriptions or are believed to be in public domain. We have used reasonable efforts to accredit the source wherever it was indicated as or found to be necessary.