\n
![](\"https:\/\/images.cointelegraph.com\/cdn-cgi\/image\/format=auto,onerror=redirect,quality=90,width=840\/https:\/\/s3.cointelegraph.com\/uploads\/2023-07\/53d30175-f0f6-4924-adb5-bb2fb76338c1.jpg\")
<\/p>\n
\n<\/p>\n
The Arcadia Finance attacker used a reentrancy exploit to drain $455,000 from the decentralized finance (DeFi) protocol, according to a July 10 post-mortem report issued<\/a> by the app\u2019s development team. A \u201creentrancy exploit\u201d is a bug that allows an attacker to \u201creenter\u201d a contract or interrupt it during a multi-step process, preventing the process from being completed correctly.<\/p>\n The team has sent a message to the attacker demanding the return of funds within 24 hours and threatening police action if the hacker fails to comply.<\/p>\n Post Mortem of ongoing situation, providing a technical overview and sharing more information on next steps.https:\/\/t.co\/NPNbbSzKBQ<\/a><\/p>\n \u2014 Arcadia Finance (@ArcadiaFi) July 10, 2023<\/a><\/p><\/blockquote>\n Arcadia Finance was exploited on the morning of July 10<\/a> and drained of $455,000 worth of crypto. A preliminary report from blockchain security firm PeckShield stated that the attacker had used a \u201clack of untrusted input validation\u201d in the app\u2019s contracts to drain the funds. The Arcadia team had denied this, stating that PeckShield\u2019s analysis was mistaken. However, the team did not explain what it thought the cause was at the time.<\/p>\n The new Arcadia report stated that the app\u2019s \u201cliquidateVault()\u201d function did not contain a reentrancy check. This allowed the attacker to call the function before a health check had been completed but after the attacker had withdrawn funds. As a result, the attacker could borrow funds and not pay them back, draining them from the protocol.<\/p>\n The team has now paused the contracts and is working on a patch to close the loophole.<\/p>\n The attacker first took a flash loan from Aave for $20,672 worth of USD Coin (USDC<\/a>) and deposited it into an Arcadia vault. Next, the hacker used this vault collateral to borrow $103,210 USDC from an Arcadia liquidity pool. This was accomplished through a \u201cdoActionWithLeverage()\u201d function that allows users to borrow funds only if their account can remain healthy by the end of the block. <\/p>\n The attacker deposited the $103,210 into the vault, bringing the total funds to $123,882. The hacker then withdrew all funds, leaving the vault with no assets and $103,210 in debt.<\/p>\n Theoretically, this should have caused all actions to revert, as withdrawing the funds should have caused the account to fail a health check. However, the attacker used a malicious contract to call liquidateVault() before the health check could commence. The vault was liquidated, eliminating all of its debts. As a result, it was left with zero assets and zero liabilities, allowing it to pass the health check.<\/p>\n Since the account passed the health check after all transactions were concluded, none of the transactions reverted, and the pool was drained of $103,210. The attacker paid back the loan from Aave within the same block. The hacker repeated this exploit multiple times, draining a total of $455,000 from pools on Optimism and Ethereum.<\/p>\n In its report, Arcadia\u2019s team pushed back against claims that the exploit was caused by untrusted input, stating that this alleged vulnerability was not \u201cthe core issue\u201d in the attack.<\/p>\n Related: <\/strong>Circle, Tether freezes over $65M in assets transferred from Multichain<\/strong><\/a><\/em><\/p>\n The Arcadia team posted<\/a> a message to the attacker using the input data field of an Optimism transaction, stating:<\/p>\n \u201cWe understand you are involved with Arcadia Finance\u2019s exploit. We\u2019re actively working with security experts and law enforcement. Your TC deposits and withdrawals on BNB were a bit too fast, it\u2019s hard to hide your identity online these days. We will escalate this with law enforcement in absence of any funds being returned within the next 24 hours.\u201d<\/p><\/blockquote>\n In its report, Arcadia claimed it had found some promising leads for tracking down the attacker. \u201cBesides obtaining addresses linked to centralized exchanges, we also uncovered links to previous exploits of other protocols,\u201d the report said. \u201cThe team is investigating both on-chain and off-chain data to the fullest extent and has multiple leads.\u201d<\/p>\n Exploits and scams have been a continuing problem in the DeFi space in 2023. A July 5 report from CertiK stated that over $300 million was\u00a0lost due to exploits<\/a> in the second quarter of the year.<\/p>\n\n