OMNI Hack

A reentrancy attack was carried out on the OMNI protocol, yielding the attacker 1300 $ETH, which were subsequently laundered through Tornado.cash.

OMNI is a NFT finance platform that lends out cryptocurrency in exchange for staked NFTs. This platform allows users to stake NFT tokens to receive fungible tokens e.g. $ETH. The attacker deposited NFTs from the collection Doodles that were used as a collateral to borrow $WETH. Then the attacker exploited a vulnerability in order to execute a reentrancy attack by withdrawing all NFTs deposited as collateral by the attacker except for one NFT. This action triggered a malicious callback function that allowed the attacker to buy more Doodles before  liquidating the loan position:

https://etherscan.io/tx/0x05d65e0a…a73996

When the position is liquidated, the remaining Doodle NFT from the collateral were returned to the attacker. The credit position is liquidated because NFT value from initial collateral is insufficient to cover the debt position. As the attacker is able to force through using the borrowed WETH to buy more NFTs before the liquidation occurs. As a result, the money received from the attack was withdrawn through Tornado.cash.

Attacker account address: https://etherscan.io/address/0x627a22ff…a1dcb9

Attacker contract address: https://etherscan.io/address/0x5992f10a…a89fa8

Contract creations transaction: https://etherscan.io/tx/0x193016ce…4f5ba5

Exploited smart contract address: https://etherscan.io/address/0xba122222…6bf2c8