February 13, 2021: The Vanishing Spell 🐰🎩✨

Alpha Homora found themselves victimized by a vanishing spell

Last night a hacker disappeared 13,245 ETH from Alpha Homora.

Alpha Finance Lab @AlphaFinanceLab

Dear Alpha community, we've been notified of an exploit on Alpha Homora V2. We're now working with @AndreCronjeTech and @CreamdotFinance together on this. The loophole has been patched. We're in the process of investigating the stolen fund, and have a prime suspect already.

It all happened last night, as @AndreCronjeTech was trying to chill at the clubhouse when @josebaredes fired off an alarm.

José Baredes @josebaredes

Not really sure what is going on here, but it looks like someone is arbing the Iron Bank contracts through this contract 0x560a8e3b79d23b0a525e15c6f3486c6a293ddad2 @bneiluj @charlie_eth @AndreCronjeTech @emilianobonassi

Monkey Rothschild @MonkeyCharts

andre was literally on clubhouse and goes "uuhhhhh i gotta go" because $cream is rugging lmao

The core of the hack was accomplished by printing and lending $sUSD in rapid succession.

alexander ▽ @alexangelj

Looks like sUSD is being duplicated?

@FrankResearcher describes the hack in full. First up, keep escalating their $sUSD borrow from the Iron Bank.

Igor Igamberdiev @FrankResearcher

IronBank ($CREAM) was exploited on $37.5M, let’s take a quick look at what happened.👇 1/ Attacker used Alpha Homora for borrowing sUSD from IronBank. Each time they borrow twice as much as in the previous one.

Igor Igamberdiev @FrankResearcher

2/ They do this through two transactions and each time they lend the funds back into IronBank, receiving cySUSD. 3/ At some point exploiter took $1.8M USDC flash loan from Aave v2 and swapped USDC to sUSD using Curve.

Hackers’ paid it back in part by taking out a flash loan on AAVE and converting it to $sUSD using Curve’s cross-asset functionality. It’s a good reminder to always pay attention to Curve.

José Baredes @josebaredes

@bneiluj @charlie_eth @AndreCronjeTech @emilianobonassi @TornadoCash @CreamdotFinance Meh guess I'm the only one awake here paying attention to @CurveSwaps

The process continued in rapid succession.

Igor Igamberdiev @FrankResearcher

4/ They lend these sUSD to IronBank, which allows them to continue borrowing and lending them, receiving cySUSD. 5/ Of course, some sUSD are spent on repayment of the flash loan.

Igor Igamberdiev @FrankResearcher

6/ Also, a 10M USD flash loan is taken, which is also used to increase the number of cySUSD. 7/ In the end, the number of their cySUSD reaches an incredible amount, which allows them to borrow anything from IronBank.

By the time they build up enough credit, they could borrow whatever they wanted.

Igor Igamberdiev @FrankResearcher

8/ Then they borrow: - 13.2k WETH - 3.6M USDC - 5.6M USDT - 4.2M DAI

The hackers’ first act was to kindly tip their victims about 10%

José Baredes @josebaredes

@bneiluj @charlie_eth @AndreCronjeTech @emilianobonassi @TornadoCash Looks like a hack. Looks like they have made off with 13k ETH and they have started sending several ETH through Tornado Cash in addition to 1,000 ETH to Alpha Homora Deployer, 1,000 ETH to Cream Finance and 100 ETH to Tornado's grant.

You can follow the activity on Etherscan at the contract address 0x905315602Ed9a854e325F692FF82F58799BEaB57.

CREAM returned to operation pretty quickly…

Cream Finance 🍦 @CreamdotFinance

C.R.E.A.M. contracts and markets were investigated and found to be functioning as normal. Markets have been re-enabled across both V1 and V2. Post mortem to follow.

…but Alpha Homora had to temporarily avada kedavra their leveraged offerings…

Alpha Finance Lab @AlphaFinanceLab

Users can't borrow more funds from Alpha Homora v2 = no new leveraged positions and borrow on existing positions. V1 is safe and operational. We're on full alert and working with @samczsun & many trusted builders to investigate the issues thoroughly. A post mortem to follow.

Prices of $ALPHA dropped about 20% following the news:

Mira Christanto @asiahodl

$ALPHA has lost $77m in market share after a $37.5m exploit. Their price has over-corrected (unless you believe futher exploits are likely). However, I disagree that there's a "suspect". If the smart contract allowed for this, then it's fair game.

Alpha Finance Lab @AlphaFinanceLab

Dear Alpha community, we've been notified of an exploit on Alpha Homora V2. We're now working with @AndreCronjeTech and @CreamdotFinance together on this. The loophole has been patched. We're in the process of investigating the stolen fund, and have a prime suspect already.

It’s another reminder that if smart contract auditors were any good at their job, they’d be wearing black hats and making millions, rather than donning white hats and making thousands:

Alpha Finance Lab @AlphaFinanceLab

Alpha Homora V2 audit, first by @Quantstamp then by @peckshield, have been completed! We've resolved the issues raised and have uploaded the 2 reports in the link below.

github.comAlphaFinanceLab/homora-v2Contribute to AlphaFinanceLab/homora-v2 development by creating an account on GitHub.

For more info, check our live market data at https://curvemarketcap.com/ or our subscribe to our daily newsletter at https://curve.substack.com/. Nothing in our newsletter can be construed as financial advice. Author is long $CRV.