What happened
Omni's July 2022 exploit used NFT transfer callbacks to re-enter its Ethereum lending contracts. The attacker recovered collateral while retaining borrowed WETH, leaving bad debt. Approximately 1,300 ETH was drained; Omni said the affected assets were internal testing funds and that users were not affected.
Technical root cause
Withdrawal and liquidation transferred ERC-721 assets before updating collateral-use configuration. Missing reentrancy protection allowed callbacks to create new borrowing state that the outer operation then incorrectly cleared.
How it happened
- The attacker used flash-borrowed assets to supply Doodles NFTs as collateral and borrow WETH.
- NFT withdrawal triggered onERC721Received before the collateral-use configuration was finalized.
- The attack chained withdrawal and liquidation callbacks, supplying collateral and borrowing again during re-entry.
- The later configuration update made the market stop treating the NFTs as collateral. The attacker withdrew them despite outstanding debt and repaid the flash loans.
Protocol details
Evidence
- report Report theblock.co
- report Report cryptopotato.com
- report Report dailycoin.com
- report Report m.investing.com
- report Hack Analysis: Omni Protocol, July 2022 medium.com
- analysis Web Archive web.archive.org
- analysis DeFiLlama defillama.com
- analysis NFT Protocol OMNI Suffers Reentrancy Attack, Loses 1,300 ETH in Testing Funds beincrypto.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
