Incident Overview
On May-28-2024, Orion protocol was exploited with a losses about of 994k USD.
The root cause was improper updating of user liabilities during the removeLiability operation. The attacker manipulated the liabilities array of a controlled account through a series of preparation transactions, doubling the value of the user's collateral assets. This manipulation allowed the attacker to bypass the health check when borrowing assets.
Specifically, due to the manipulated liabilities for account 0xf7a8c2, the exploiter borrowed more assets than allowed. The technical failures included inadequate handling logic in the removeLiability function and the failure to update user liabilities when releasing assets.
Attacker:
https://bscscan.com/address/0x51177db1…8288d2
Exploit tx:
https://bscscan.com/tx/0x660837a1…cae18c
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Orion, these are the critical security checks that could have prevented this incident (May 2024).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Orion
The Orion hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.