What happened
On October 3, 2024, an unknown lending project on the Arbitrum network suffered a $130,000 loss due to a price oracle manipulation attack involving the WETH-USDC liquidity pool.
The hacker exploited the lending protocol's reliance on a price feed from the UniswapV3Pool to manipulate the value of WETH-USDC LP tokens. Initially, the price of the LP tokens was 5,826,926,145,978,180, but after manipulation, the price jumped to 8,131,590,584,988,874. The attacker first deposited LP tokens, then deposited USDC and borrowed additional LP tokens.
During the borrowing, the price of the tokens was artificially low, but the attacker manipulated it to rise, allowing them to withdraw all the LP tokens from the pool.
Transaction Hash: 0xb5cfa4ae…947216
Protocol details
Evidence
- report @rotcivegaf incident report x.com
- report @0xNickLFranklin incident report x.com
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
