N/A Hack

On October 3, 2024, an unknown lending project on the Arbitrum network suffered a $130,000 loss due to a price oracle manipulation attack involving the WETH-USDC liquidity pool.

The hacker exploited the lending protocol's reliance on a price feed from the UniswapV3Pool to manipulate the value of WETH-USDC LP tokens. Initially, the price of the LP tokens was 5,826,926,145,978,180, but after manipulation, the price jumped to 8,131,590,584,988,874. The attacker first deposited LP tokens, then deposited USDC and borrowed additional LP tokens.

During the borrowing, the price of the tokens was artificially low, but the attacker manipulated it to rise, allowing them to withdraw all the LP tokens from the pool.

Transaction Hash: 0xb5cfa4ae…947216