Hope Lend Hack

What happened

On October 18, 2023, HopeLend on Ethereum lost about 528 ETH, reported as $834,616. A precision error while burning hETHwBTC deposit certificates let an attacker manipulate the liquidity index of a nearly empty pool and use the resulting inflated collateral value to borrow from other HopeLend pools. A separate mempool front-runner copied the transaction and received the proceeds; CertiK reports that Hope.money later allowed the front-runner to retain 26 ETH as a bounty and moved the remaining funds to a Gnosis Safe.

How it happened

1. The attacker used a flash loan and supplied 2,000 WBTC to the hETHwBTC pool.
2. Repeated deposits, withdrawals, and flash-loan repayments raised the pool liquidity index while the attacker retained a minimum hETHwBTC unit.
3. Integer-division truncation burned fewer deposit certificates than required for a withdrawal, leaving the minimum unit available at an inflated collateral value.
4. That inflated collateral supported borrowing assets from five other HopeLend pools. A front-runner copied the pending exploit transaction and captured the proceeds first.

Protocol details

Classification Other / Token & Share Accounting

Protocol Type Lending

Affected asset / contract HOPE

Implementation language Solidity

Protocol links Website @Hope_money_

Evidence

• report @officer_cia incident report twitter.com
• report De.Fi Rekt Report: $20.8m Funds Lost in October 2023 de.fi
• transaction Attack transaction · Etherscan etherscan.io
• address Attacker address · Etherscan etherscan.io
• address Original attacker address · Etherscan etherscan.io
• address Funds holder as of October 26, 2023 · Etherscan etherscan.io
• address Block producer address · Etherscan etherscan.io
• address Attack contract · Etherscan etherscan.io
• analysis Web Archive archive.ph
• analysis DeFiLlama defillama.com
• analysis HopeLend Incident Analysis certik.com
• analysis Hope Money Hack Analysis blog.solidityscan.com