Latest DeFi bridge exploit results in $4.4M losses for Meter

The Meter Passport token bridge platform has incurred $4.4 million in losses as a result of a wise contract hack which additionally induced Hundred Finance to lose $3.3 million by under-collateralized loans.

Meter.io’s Meter Passport (MTRG) is a token bridge that’s suitable with Ethereum and its sidechains. This assault affected the Moonriver aspect of the bridge.

Moonriver is a brilliant contract platform based mostly on Polkadot’s Kusama community. Hundred Finance is a crypto lending platform based mostly on the code for Compound Finance.

Beginning at 2pm UTC on Feb. 5 and over the course of a number of transactions, about $4.4 million in Binance Coin (BNB) and wETH have been minted by a “mistaken belief assumption” within the code, based on a Feb. 6 statement from the Meter staff. On this case, an arbitrary quantity of ETH was deposited to Meter which the hacker used to mint tokens utilizing the vulnerability.

1. Round 6am Pacific time we recognized somebody was capable of leverage a vulnerability of the bridge to mint a considerable amount of BNB and WETH tokens and depleted the bridge reserve for BNB on WETH.

— ⚡️Meter.io⚡️ (@Meter_IO) February 5, 2022

The assault induced a cascade impact throughout the Kusama-based Moonriver ecosystem. After draining Meter of its BNB and wETH reserves, the attacker offered the BNB on SushiSwap, a well-liked decentralized change. This led to a 77% crash within the value of BNB on Moonriver on the time.

A variety of opportunists then took benefit of the value dip by shopping for low-cost BNB. They used the tokens as collateral on Hundred Finance with a view to take out ETH, FRAX, and MIM loans. Because of the discrepancy in BNB value, nevertheless, their loans have been price greater than the collateral they’d offered, inflicting a provide disaster.

2/4. Accounts have been capable of buy BNB.bsc at a decreased value and use these tokens as collateral on the international Chainlink value to borrow uncompromised property on our platform. Of those, MIM and FRAX are presently impacted.

— Hundred Finance (@HundredFinance) February 6, 2022

Amazingly, two of the loans have been repaid, leaving an excellent $3.3 million in losses to the Hundred protocol. The ETH mortgage was fully returned. The Hundred staff has tried to succeed in out to the events concerned to ask that they return the BNB tokens used as collateral to Meter.

The Meter staff has dedicated to reimbursing its neighborhood and Hundred Finance for losses incurred as a result of hack. The staff stated on Feb. 6 that it had put aside $4.4 million in MTRG tokens to cowl preliminary losses.

“Vfat”, the pseudonymous founding father of Hundred Finance, mentioned in a press release to Rekt News on Feb. 6 that:

“Meter have after all accepted duty for this hack and are intending to make use of their native token for reimbursement to the extent that they will, presently we’re within the gathering addresses and quantities stage.”

Associated: Qubit Finance suffers $80 million loss following hack

The blockchain safety agency PeckShield estimated that in complete, 1,391 ETH and a pair of.74 wBTC have been taken by the attacker and have since been despatched to Ethereum the place the tokens have gone by Twister Money, an ETH transactions privateness device.

A consultant from the Hundred Finance staff advised Cointelegraph that it might wait a couple of day earlier than taking steps to reopen MIM and FRAX markets on its platform. In response to a query on bridge safety, the Hundred staff advised Cointelegraph:

“We hope bridges will strengthen their safety and make their tech safer. As for us we shall be much more stricter with property and bridges on new chains.”

The preliminary particulars of the exploit of Meter’s code resemble the Wormhole hack on Feb. 3 wherein 120,000 wETH ($321 million) have been maliciously minted and extracted from Wormhole’s platform. In that incident, the hacker exploited a wise contract bug to mint wETH at will and despatched the tokens to Ethereum, the place they have been washed through Twister Money.

Article up to date so as to add the ETH mortgage on Hundred Finance has been paid again.