Lodestar V0 Hack

Unreconciled loss Not disclosed
Arbitrum
Flashloan Price Oracle Attack

What happened

On 10 December 2022, Lodestar Finance on Arbitrum was drained after its GLPOracle treated a manipulable plvGLP exchange rate as collateral value. The attacker inflated the rate, borrowed most of the available Lodestar liquidity against overvalued collateral, and left the protocol with more than $6 million of bad debt.

Technical root cause

The GLPOracle derived plvGLP price from an exchange rate based on totalassets / totalsupply. A direct donation increased totalassets while leaving supply unchanged, so the oracle price could be inflated and then used to overstate collateral. SourceHat later recorded this as a high GLPOracle finding and recommended a TWAP or excluding plvGLP as collateral.

How it happened

  1. The attacker used flash loans and repeated Lodestar borrow/lend operations to obtain and control a large plvGLP position.
  2. The attacker called a donation path that increased the underlying assets counted by the Plutus vault without increasing token supply, pushing the plvGLP exchange rate and the Lodestar oracle price upward.
  3. Lodestar accepted the inflated plvGLP value as collateral, allowing the attacker to borrow the remaining available assets far beyond the collateral's true value.
  4. After repaying the flash loans, the attacker redeemed the manipulated position for roughly 4,527 ETH (about $5.8 million in the flow described by CertiK); the report traces the funds to Ethereum and three externally owned addresses.
  5. Lodestar said about 2.8 million GLP, worth roughly $2.4 million at the time, might be recoverable, but CertiK recorded no response to its negotiation offer at publication.

Protocol details

Classification Ecosystem / Oracle Manipulation / Borrowing and Lending
Protocol Type Lending
Affected asset / contract LODE
Implementation language Solidity
Protocol links Website @LodestarFinance

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Flash Loan Attacks Oracle Manipulation & Price Manipulation

Same attack technique

Browse all hacks →
Solana Nirvana V1 $3.5M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes