What happened
On March 15, 2022, Hundred Finance and Agave DAO were hit by the same reentrancy attack on Gnosis (xDai). The report attributes 2,363 ETH, about $6.2 million, to Hundred Finance and says the funds were later moved to an attacker Ethereum address and then to Tornado Cash.
How it happened
- The attacker used flash loans as initial collateral.
- The xDAI token's
callAfterTransfer()design allowed reentrant execution. - Nested borrow calls increased the amount borrowed before the protocol updated the debt balance.
- Repeating that sequence let the attacker borrow assets worth substantially more than the collateral and move the Hundred proceeds to Ethereum.
Protocol details
Classification
Ecosystem / Borrowing and Lending / Reentrancy
Protocol Type
Lending
Affected asset / contract
HND
Implementation language
Solidity
Protocol links
Website
@HundredFinance
Security review history
- Chainsulting View report
Evidence
Proof of concept
1 availableSources
- report Post-mortem medium.com
- report Agave DAO, Hundred Finance — REKT rekt.news
- report @HundredFinance incident report twitter.com
- report @PeckShieldAlert incident report twitter.com
- transaction Transaction gnosisscan.io
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
