Incident Overview
Ethereum-based Inverse Finance was exploited for more than $1.2 million by an attacker utilizing an oracle manipulation through a flash loan attack.
1) The attacker flashloaned 27,000 WBTC using it's contract from AAVE. Then WBTC was added as liquidity to the Curve pool.
2) The obtained LP tokens were deposited to the Yearn’s Vault. Yearn’s Vault tokens were deposited to Inverse Finance’s Yearn 3Crypto Vault to serve as collateral on Inverse Finance.
3) The attacker's then uses the remaining 26,775 WBTC of the initial flashloan to swap for 75M USDT on Curve 3Crypto. It manipulates the pricing oracle that let's the attacker is then able to borrow $10M worth of Dola USD StableCoin.
4) Then, the 75M USDT is swapped for 26,626 WBTC.
5) The attacker then uses the borrowed DOLA to provide liquidity to the Curve Metapool. When the liquidity is ~10.1M USDT, it is removed.
6) Then, it converts 10M USDT to 451 WBTC using the 3Crypto pool on Curve. A remaining 99,976.294 USDT was kept in the attacker’s smart contract.
Exploit transaction: https://etherscan.io/tx/0x95823626…f9313c
Exploiter address: https://etherscan.io/address/0x7b792e49…4deec6
Exploiter contract: https://etherscan.io/address/0xf508c58c…f92e2d
Withdrawing 100K USDT: https://etherscan.io/tx/0x3d2f86c1…77a9f7
Withdrawing 53.24 WBTC: https://etherscan.io/tx/0x9959f8f1…1fa60c
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Inverse Finance, these are the critical security checks that could have prevented this incident (June 2022).
- Verify all logic paths related to Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Inverse Finance
The Inverse Finance hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.