What happened
On October 28, 2022, an attacker drained about $144,000 in USDC from Deri Protocol's trading pool on Arbitrum by exploiting how the protocol margined and liquidated far out-of-the-money options. Using two linked accounts funded with only 766 USDC, the attacker built a huge long position in one account and a matching short in the other on the BTCUSD-40000-C everlasting option. When the long account was liquidated, the forced sale pushed the option's mark price below zero, but the account could only lose its tiny margin.
The short account closed at a large profit, and the pool absorbed the difference. Deri reports the attacker withdrew 144,388.57 USDC, a net profit of 143,622.57 USDC.
How it happened
- The attacker deposited 750 USDC and 16 USDC of margin into two accounts, A and B.
- Over hundreds of rounds, A bought a small amount of
BTCUSD-40000-Cand B immediately sold the same amount, returning the mark price to where it was. Deri's very low margin requirement for far out-of-the-money options let this build to about 100,192 BTC notional long in A and about 96,940 BTC short in B, leaving A at maximum leverage. - The attacker made A's volume slightly larger than B's, pushing the funding rate up so A kept paying funding to B and drifted toward liquidation.
- When BTC fell, A dropped below maintenance margin and was liquidated. The liquidation sold the entire position at once and, with no lower bound on price during liquidation, drove the mark price below zero. A's theoretical loss of about $144,000 was capped at its margin balance.
- The attacker closed B's short against the collapsed price for a profit of about $144,000 and withdrew it; because A's matching loss could not be collected, the pool took the loss.
Protocol details
Security review history
- PeckShield View report
- CertiK View report
Evidence
- report @DeriProtocol incident report twitter.com
- transaction Arbiscan transaction 0x537dc5bf...2e04 (liquidation) arbiscan.io
- transaction arbiscan.io transaction 0xc31a…c93d arbiscan.io
- address arbiscan.io address address arbiscan.io
- analysis The Detailed Process of the 2022.10.28 Attack on Deri Protocol deri-protocol.medium.com
- analysis Everlasting Options FAQ | Deri Protocol Docs docs.deri.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
