DeFi Protocol Conic Finance Hacked for 1700 ETH

DeFi protocol Conic Finance reported a loss of 1700 ETH, valued at over $3.2 million. Blockchain security firm BlockSec has traced this incident to an unidentified hacker exploiting a reentrancy vulnerability early this morning.

Conic promptly alerted its user base via Twitter, confirming the exploit involving the ETH Omnipool, launched July 10, and only affecting ETH pools.

We are currently investigating an exploit involving the ETH Omnipool and will share updates as soon as they are available.

— Conic Finance (@ConicFinance) July 21, 2023

Conic Finance, known for allocating funds through the Curve decentralized exchange using liquidity pools, fell foul of a two-pronged attack involving the vulnerability and manipulation of a price oracle.

In this case, the attacker took out a flash loan of 20,000 staked ETH, redirecting it towards Conic’s price oracle, facilitating the exploit. The vulnerability was used in conjunction with a manipulation of Conic’s price oracle, which obtains its data from a third-party read-only smart contract.

Hi @ConicFinance Based on the initial analysis from the malicious tx, our initial analysis shows the root cause comes from the new CurveLPOracleV2 contract.https://t.co/JmunQImiE5

FWIW, our audit identifies a similar read-only reentrancy issue. However, the same issue is… https://t.co/lTgYq4Xp49 pic.twitter.com/bXXC7y1OCL

— PeckShield Inc. (@peckshield) July 21, 2023

In a tweet, Conic updated its community: “Update: – We are continuing to investigate the root cause of the exploit and are consulting with relevant parties. – We have disabled ETH Omnipool deposits on the Conic front end.”