What happened
On November 1, 2023, an attacker drained about $2.15 million from Onyx Protocol's Ethereum lending markets after exploiting the newly activated oPEPE market. A near-empty receipt-token market allowed the attacker to inflate oPEPE's exchange rate through a direct PEPE donation, then use a rounding flaw in the Compound-derived accounting to turn that distorted value into borrowable collateral.
A freshly deployed, insufficiently seeded receipt-token market permitted donation-driven cash-to-share exchange-rate inflation. With near-zero oPEPE supply, Compound-fork integer rounding in the redemption path failed to charge meaningful shares for withdrawn underlying.
Case & protocol details
Attack Timeline
The attacker executed the proposal creating the oPEPE market, borrowed 4,000 WETH from Aave, and acquired PEPE. By minting and redeeming oPEPE, the attacker reduced its supply to a tiny value. A direct PEPE donation then made each remaining oPEPE share appear extraordinarily valuable.
At that extreme exchange rate, redeemUnderlying rounded the share charge down to almost nothing. The attacker repeatedly borrowed against the inflated collateral, redeemed underlying, and drained assets from other Onyx markets before repaying the flash loan.
Security review history
- CertiK Report
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report twitter.com
- transaction Transaction etherscan.io
- analysis Web Archive archive.ph
- analysis Website reference twitter.com
- analysis Onyx Community: Recovery Proposal community.onyx.org
- analysis MetaTrust: Onyx Governance and Vulnerability Analysis metatrust.io
- analysis SharkTeam: Onyx Exploit Analysis sharkteam.org
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.