Tender.fi White Hat Hacker Returns $1.6 Million Loot for 62.15 ETH

• A white hat hacker has returned $1.6 million that was exploited from Tender.fi.
• The hack occurred earlier this week following a glitch in Chainlink’s pricing oracle.
• The hacker was given a bounty of 62.15 ETH ($98,000) for their help in securing the platform.

Decentralized finance (DeFi) protocol Tender.fi has been made whole thanks to the hacker who returned $1.6 million that were exploited from the platform earlier this week. The white hat hacker noticed a glitch in Tender.fi’s pricing oracle, which allowed them to borrow a significant amount against a modest deposit.

According to a post-mortem report published by Tender.fi earlier today, the DeFi lending protocol had upgraded its price feed to Chainlink’s price oracle on March 6, a day before the exploit. The new price feed derived the price of the GMX token from Chainlink, rather than a time-weighted average price (TWAP). The new code was reportedly audited by blockchain intelligence firm PeckShield.

However, the Chainlink price oracle had a glitch, due to which the hacker was able to deposit one GMX token worth nearly $70 at the time and borrow a whopping $1.6 million against that deposit. A decimal error in the Solidity contract caused the contract to treat the 1 GMX collateral as having more value on Tender.fi than all Bitcoin in existence.

The white hat left an on-chain message for the protocol after borrowing the huge sum which read, “It looks like your oracle was misconfigured. Contact me to sort this out.” The Tender.fi team reached out to the hacker over DeBank and negotiated repayment of the massive loan in exchange for a bounty of 62.15 ETH worth nearly $100,000 at the time.