Citadel Finance Hack

Citadel Finance suffers flash loan attack, losing about $97,000 USD worth of 43.34 ETH on Arbitrum chain.

On January 27th, 2024, Citadel Finance, a Treasury-Backed Protocol on the Arbitrum chain, was exploited through a flash loan attack. The attacker manipulated the price of underlying assets, specifically the WETH/USDC pair on the Camelot Router. By taking a flash loan of approximately 4500 WETH and depositing it with the Camelot LP, the attacker was able to manipulate the WETH/USDC.E pool pair.

They then called the redeem function from the CITRedeem contract to get huge amounts of WETH from the treasury with a low amount of CIT. Approximately 30.95 CIT tokens were burned, and the attacker took away assets worth 21.326 WETH. The flash loan was repaid, and the attacker was able to retain the excess funds as profit.

The attacker used this scheme a couple times. The stolen funds were transferred to another EOA and then deposited into Fixed Float, resulting in a total loss of $97,000 USD worth 43.34 ETH.

Attacker address:

https://arbiscan.io/address/0xfCf88e5E…3F8b49

Malicious transactions:

https://arbiscan.io/tx/0xf52a681b…006855

https://arbiscan.io/tx/0x89eafbcd…3349a2

Malicious contract:

https://arbiscan.io/address/0xfCBf4112…9eA5A6

Fixed Float Deposit transactions:

https://arbiscan.io/tx/0x36bc4c82…585725

https://arbiscan.io/tx/0x62a0012a…bf1176

https://arbiscan.io/tx/0xbc9811fb…f3c145