BlueBerry Hack

TOTAL LOST $1.4M

Medium Feb 24, 2024 Flash Loan Attacks Ethereum

What happened

Blueberry's Ethereum lending market was exploited after a faulty oracle deployment valued low-decimal assets incorrectly and borrowing was enabled earlier than intended. About $1.4 million was affected; a whitehat front-ran and returned roughly 80%, and Blueberry committed its multisig funds to make lenders whole.

Technical Root Cause

PriceOracleProxy delegated to a CoreOracle that returned prices at 18 decimals. Assets with fewer decimals were incorrectly valued when borrowed, and borrowing had been enabled before the configuration was intended to go live.

Case & protocol details

Classification Oracle decimal-scaling misconfiguration / collateral-valuation error

Protocol Type Yield

Smart Contract Language Solidity

Official Website app.blueberry.garden

Protocol Twitter/X @blueberryFDN

Exploit Transaction 0xf0464b01d962f714ee…346b8b06e4

Attack Timeline

The attacker used a 1 WETH Balancer flash loan, deposited it into the lending market, and borrowed available liquidity in assets with fewer than 18 decimals, which the misconfigured oracle severely undervalued. The drained assets included OHM, USDC, and WBTC.

A whitehat front-ran and returned about 80% to the DAO multisig. The remaining amount was lost to the validator, while Blueberry stated it had sufficient multisig funds to reimburse lenders.