What happened
Origin's retrospective dates the OUSD exploit to November 16, 2020 and reports a $7 million loss. Early reports put the loss at about $8 million; this page uses the protocol's own loss figure. A missing asset-validation check let a malicious token trigger reentrancy during minting.
A gas-saving refactor omitted a validation check. This allowed an attacker-controlled token into a mint path whose external call could reenter the vault.
How it happened
The attacker used the malicious token interaction to reenter vault accounting and obtain more OUSD value than the deposited backing justified. The exploit combined invalid input acceptance with unsafe behavior across an external call; treating either issue alone as harmless missed the combined failure.
Origin reports restoring the validation check and adding reentrancy protection. It also announced compensation equal to users' deposited value. Compensation is not evidence that stolen assets were recovered from the attacker.
A useful regression test rejects unsupported assets at every mint entry point and checks that token callbacks cannot change accounting mid-operation.
Protocol details
Evidence
- report Post-mortem rekt.news
- transaction Etherscan: Origin Dollar exploit transaction etherscan.io
- analysis Blog reference blog.originprotocol.com
- analysis DeFiLlama defillama.com
- analysis Origin: OUSD incident retrospective and remediation originprotocol.com
- analysis PeckShield: Origin Dollar Incident Root Cause Analysis peckshield.medium.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
