What happened
Onyx Protocol's Ethereum lending market was exploited through its NFTLiquidation contract. Onyx identified this as the primary vulnerability and said XCN staking and farming were unaffected. Its response proposed closing the Ethereum lending market and reimbursing suppliers.
Technical root cause
NFTLiquidation accepted untrusted input without sufficient validation, enabling manipulation of self-liquidation rewards. Halborn also identified a low-liquidity precision weakness, while Onyx stressed that the empty-market condition was not the primary cause.
How it happened
- The attacker used flash-loaned capital to interact with Onyx's lending markets.
- Halborn's analysis describes exchange-rate manipulation involving a low-liquidity market and precision errors.
- Insufficient input validation in NFTLiquidation also allowed the attacker to manipulate the self-liquidation reward and drain assets.
- Onyx's post-mortem emphasized the liquidation vulnerability as the primary issue.
Protocol details
Evidence
- report Report bitget.com
- report @OnyxDAO incident report x.com
- report @blocksecteam incident report x.com
- analysis DeFiLlama defillama.com
- analysis Onyx Protocol Money Markets Post Mortem community.onyx.org
- analysis Explained: The Onyx Protocol Hack (September 2024) halborn.com
- analysis Onyx 再次被攻击损失 $3.8M tenarmor.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
