What happened
The attacker's wallet:
The exploit contract:
The transaction behind the attack:
The attack was enabled via a flash loan-assisted price manipulation of the LP tokens, which resulted in a greater quantity of OShare tokens being removed from the protocol.
After the contract deployment, the hacker borrowed $80m USDC utilizing Solidly flash loans to boost the price of our underlying LP tokens in a single block, changing the price of OShare and driving a huge number of OShare tokens out of the protocol.
Stolen funds were bridged to Ethereum and deposited into Tornado Cash mixer:
Protocol details
Classification
Yield Aggregator / Access Control
Protocol Type
Exploit/Flash Loan Attack
Affected asset / contract
RING
Implementation language
Solidity
Protocol links
Website
@Onering_Finance
Evidence
- report Post-mortem medium.com
- report @peckshield incident report twitter.com
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
