Onyx Protocol oPEPE Hack
What happened
On November 1, 2023, an attacker drained about $2.15 million from Onyx Protocol's Ethereum lending markets after exploiting the newly activated oPEPE market. A near-empty receipt-token market allowed the attacker to inflate oPEPE's exchange rate through a direct PEPE donation, then use a rounding flaw in the Compound-derived accounting to turn that distorted value into borrowable collateral.
A freshly deployed, insufficiently seeded receipt-token market permitted donation-driven cash-to-share exchange-rate inflation. With near-zero oPEPE supply, Compound-fork integer rounding in the redemption path failed to charge meaningful shares for withdrawn underlying.
How it happened
- The attacker activated the new oPEPE market through the governance proposal and used a flash loan to acquire PEPE.
- Minting and redeeming oPEPE reduced receipt-token supply to a tiny balance. A direct PEPE donation then sharply increased the cash backing each remaining share.
- The attacker borrowed against that inflated collateral. At the extreme exchange rate,
redeemUnderlying()rounded down the number of shares required to withdraw underlying tokens. - Borrowing and redemption drained other Onyx markets before the flash loan was repaid.
The critical combination was a nearly empty market, donation-sensitive accounting, and redemption rounding. The flash loan supplied capital; it was not itself the vulnerability.
Protocol details
Security review history
- CertiK View report
Evidence
- report @decurityhq incident report twitter.com
- report @DeDotFiSecurity incident report twitter.com
- transaction Ethereum exploit transaction 0xf7c216... etherscan.io
- analysis Web Archive archive.ph
- analysis DeFiLlama defillama.com
- analysis Onyx Community: Recovery Proposal community.onyx.org
- analysis MetaTrust: Onyx Governance and Vulnerability Analysis metatrust.io
- analysis SharkTeam: Onyx Exploit Analysis sharkteam.org
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
