What happened
On April 22, 2023, an attacker took about $700,000 from FilDA, a multi-chain lending protocol, through its deployments on Elastos Smart Chain (ESC) and REI Network. The attack used deprecated markets that existed only on those two chains and had no deposits left, such as the HBTC market on ESC. By manipulating the exchange rate between the market's cToken and HBTC, the attacker could borrow more than their collateral was worth. FilDA said no other deployments were affected.
FilDA paused ESC and REI and named the attacker address 0x7Bb3E4261043e022A50725293cB26aC3Abe9BAE5. It said the attacker's funding traced back to centralized exchange accounts, and it asked law enforcement to pursue the case. The attacker bridged part of the stolen ELA out of ESC: 200,000 ELA to Ethereum and 80,000 ELA to BNB Chain.
By April 27, FilDA had recovered 80,000 ELA itself and the attacker had returned 162,000 ELA, 21,079 DAI and about 16.84 ETH. In May, FilDA said it was still negotiating for more and working on a way to make users whole.
How it happened
- FilDA is a Compound-style lender. A market's exchange rate is
(cash + totalBorrows - totalReserves) / totalSupply, where cash is the underlying token balance the market contract holds. - The HBTC market on ESC was deprecated and empty, so its cToken supply was tiny and easy to control.
- The attacker deposited into the empty market, then sent a large amount of HBTC straight to the market contract. That raised cash, and with it the exchange rate, without minting new cTokens.
- With their cTokens now valued far above what they had actually deposited, the attacker borrowed other assets from FilDA worth more than their real collateral. FilDA's statement shows the attacker repeated deposit-and-borrow operations through abandoned zero-balance pools.
Protocol details
Security review history
- SlowMist View report
- KnownSec View report
Evidence
- transaction Elastos Smart Chain explorer: transaction 0x2ef210f2...635d esc.elastos.io
- analysis DeFiLlama defillama.com
- analysis FilDA Exploit Statement, April 23rd, 2023 (FilDA, Wayback copy) fildafinance.medium.com
- analysis FilDA Exploit Update 2, April 27th, 2023 (FilDA, Wayback copy) fildafinance.medium.com
- analysis Lending Rate Manipulation: Investigating the FilDA Finance Attack (CertiK) certik.com
- analysis FilDA Exploit Update 3, May 11th, 2023 (FilDA, Wayback copy) fildafinance.medium.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
