Float Protocol Hack

Float Protocol's pool was exploited via Oracle Manipulation which led to a loss of 1,440,724 $USD.

Float Protocol is a staking and earning platform running on the Ethereum chain. The protocol's Rari 90 pool was exploited via Oracle Manipulation, which allowed the attacker to gain 1,440,724 $USD worth of assets including $FRAX, $FEI, and $DAI. The attack started with 47 $ETH withdrawn from TornadoCash and then used to buy $FLOAT tokens from the UniV3 pool.

The action led to the $FLOAT price being higher than usual, and then Rari 90 pool that uses UniV3 pool as an oracle was exploited. The exploiter returned 250,000 $USDC to the protocol's multisig wallet. The rest of the stolen funds were transferred through TornadoCash.

Attacker address:

Address 0xa2ce…a0e5

Malicious transactions:

Tx 0x7187…fcfe

Tx 0x40db…7248

Tx 0xf09c…cacf

Malicious contract:

Address 0x6cee…ade0

Return transaction:

Tx 0x560c…bb0e