DeltaPrime Hack

On November 11th, 2024, DeltaPrime, a DeFi protocol operating on both Arbitrum and Avalanche networks, experienced a sophisticated exploit leading to a $4.75 million loss.

The DeltaPrime exploit was rooted in two key vulnerabilities: improper validation of borrowing in the swapDebtParaSwap function and unchecked external contract inputs in the claimReward function. In the first instance, the attacker used 59.9 ETH as collateral to borrow 1.18 WBTC. The _repayAmount variable was not validated, allowing the attacker to use a malicious contract to transfer borrowed WBTC without initiating a repayment check, sending it to another address.

The second flaw involved the claimReward() function. This function accepted arbitrary external contract addresses for reward claims, which the attacker exploited by passing a malicious contract through the pair parameter. This contract manipulated the internal balances of DeltaPrime, deceiving the protocol into paying out additional rewards. Specifically, the attacker’s contract triggered the wrapNative() function, converting ETH collateral into WETH, which then appeared as a rewardable balance. This trick allowed the attacker to extract 59.9 ETH as rewards.

Instead of cashing out, the attacker chose a novel strategy, reinvesting the stolen assets across DeFi platforms on Avalanche. This included $600K staked in USDC via Stargate, $518K in liquidity for USDC/USDT pairs, 4,865 AVAX staked, 49.68 WETH.e, and 6.34 BTC.b. DeltaPrime acknowledged the incident via social media and their Discord server, highlighting the heaviest losses in AVAX and ETH pools on Avalanche and in ARB and ETH pools on Arbitrum. They have since reached out to the attacker in hopes of recovering the stolen assets.

Exploit TXs:

https://avascan.info/blockchain/c/tx/0xece4efbe…d2b59e

https://arbiscan.io/tx/0x9efe855c…83ab5c