Orion Hack

On May-28-2024, Orion protocol was exploited with a losses about of 994k USD.

The root cause was improper updating of user liabilities during the removeLiability operation. The attacker manipulated the liabilities array of a controlled account through a series of preparation transactions, doubling the value of the user's collateral assets. This manipulation allowed the attacker to bypass the health check when borrowing assets.

Specifically, due to the manipulated liabilities for account 0xf7a8c2, the exploiter borrowed more assets than allowed. The technical failures included inadequate handling logic in the removeLiability function and the failure to update user liabilities when releasing assets.

Attacker:

https://bscscan.com/address/0x51177db1…8288d2

Exploit tx:

https://bscscan.com/tx/0x660837a1…cae18c