Incident Overview
A reentrancy attack was carried out on the OMNI protocol, yielding the attacker 1300 $ETH, which were subsequently laundered through Tornado.cash.
OMNI is a NFT finance platform that lends out cryptocurrency in exchange for staked NFTs. This platform allows users to stake NFT tokens to receive fungible tokens e.g. $ETH. The attacker deposited NFTs from the collection Doodles that were used as a collateral to borrow $WETH. Then the attacker exploited a vulnerability in order to execute a reentrancy attack by withdrawing all NFTs deposited as collateral by the attacker except for one NFT. This action triggered a malicious callback function that allowed the attacker to buy more Doodles before liquidating the loan position:
https://etherscan.io/tx/0x05d65e0a…a73996
When the position is liquidated, the remaining Doodle NFT from the collateral were returned to the attacker. The credit position is liquidated because NFT value from initial collateral is insufficient to cover the debt position. As the attacker is able to force through using the borrowed WETH to buy more NFTs before the liquidation occurs. As a result, the money received from the attack was withdrawn through Tornado.cash.
Attacker account address: https://etherscan.io/address/0x627a22ff…a1dcb9
Attacker contract address: https://etherscan.io/address/0x5992f10a…a89fa8
Contract creations transaction: https://etherscan.io/tx/0x193016ce…4f5ba5
Exploited smart contract address: https://etherscan.io/address/0xba122222…6bf2c8
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to OMNI, these are the critical security checks that could have prevented this incident (July 2022).
- Verify all logic paths related to Reentrancy are guarded by proper access controls and input validation - see the Reentrancy attack class for patterns
- Check that all state-changing functions follow the Checks-Effects-Interactions (CEI) pattern to prevent reentrancy and logic ordering bugs
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
- 01
- 02
- 03
- 04
- 05
Learn to Prevent the Next OMNI
The OMNI hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.