Arbitrum-based decentralized finance (DeFi) protocol Rodeo Finance was exploited for $1.53 million on July 11. The DeFi protocol was exploited using a code vulnerability in its Oracle leading to a loss of over 810 Ether (ETH).
According to data shared by blockchain analytic group Peckshield, the exploiter later bridged the stolen funds from Arbitrum to Ethereum and swapped 285 ETH for $unshETH. The exploiter then deposited the ETH on ETH2 staking. Finally, the exploiter routed the stolen ETH using the popular mixer service Tornado Cash which is often used by exploiters as an exit route as these mixers help obscure the transaction’s footprint.
The exploiter made use of Time-Weighted Average Price (TWAP) Orcale manipulation. TWAP Oracle is used by DeFi protocols to calculate the average price of an asset for a specific time frame to mitigate price fluctuation due to the volatility in the crypto market.
However, it offers a vulnerability for exploiters to manipulate these oracles by artificially skewing the calculated average price of an asset. This allows them to gain the upper hand during a transaction and then exploit the protocol.
An exploiter first borrows a large sum of an asset and then artificially manipulates the price to buy the same asset at a deflated price. Later the exploiter returns the loan and makes a profit based on the low price managed by manipulations.
Related: Crypto scams are going to ramp up with the rise of AI
The exploiter wallet address still holds over 374 ETH and Etherscan has marked the address as linked to the Rodeo exploit, The DeFi protocol had $20 million in total value locked (TVL) which has fallen below $500 after the exploit.
The exploit also tumbled the price of the native token of the DeFi protocol, which dropped by over 53% in the past 24 hours.
In 2023 alone, there have been 21 recorded incidents of some form of exploit on the Arbitrum Network with a combined loss of over $20 million. The latest exploit of $1.53 million makes it the fifth largest recorded on Aribitrum in 2023. Rodeo Finance was also exploited on 05 July 2023 for ~$89,000 due to a vulnerability in their ‘mintProtocolReserves’ function.
Magazine: Should you ‘orange pill’ children? The case for Bitcoin kids books