Ovix Hack

Reported loss $2.0M
Polygon
Flash Loan Attack

What happened

On April 28, 2023, an attacker drained about $2 million from 0VIX, a lending protocol on Polygon, by manipulating the price oracle for its vGHST market. vGHST is the share token of Gotchi Vault, and 0VIX priced it from the vGHST-to-GHST conversion rate, an oracle that Everything Blockchain describes as open to donation-based price manipulation. Inside a flash-loan transaction the attacker inflated the vGHST price and used the distorted valuation to pull stablecoins out of the protocol. The attacker left with about 1.45M USDC and 584k USDT, which Decrypt reported as roughly $1.4M USDC and $600K USDT.

0VIX paused its Polygon PoS and zkEVM markets. A joint investigation by 0VIX and PeckShield found the vulnerable vGHST oracle had been added on March 17, 2023. After a Gotchi Vault DAO vote, 206k vGHST was recovered. When Everything Blockchain published its analysis in May 2023, a further 763k GHST was still held by the Aavegotchi DAO while talks continued.

  • Attacker EOA: 0x702ef63881b5241ffb412199547bcd0c6910a970
  • Exploiter contracts: 0x49c6dd832d76fb9dd0dfd3a889775faa51af095c, 0x407feaec31c16b19f24a8a8846ab4939ed7d7d57
  • Exploit transaction: 0x10f2c28f5d6cd8d7b56210b4d5e0cece27e45a30808cd3d3443c05d4275bb008

How it happened

  1. The attacker took flash loans, deposited about 24.5M USDC into 0VIX as collateral, and borrowed about 5.4M USDT and 720k USDC. It also opened a position that borrowed vGHST.
  2. It then inflated the vGHST price reported by 0VIX's oracle, which depended on the vGHST-to-GHST conversion rate. BlockSec confirmed that vGHST was artificially inflated and its oracle manipulated.
  3. At the inflated vGHST price, the attacker's own vGHST debt made its position liquidatable. The attacker liquidated that position repeatedly and took back its USDC collateral.
  4. It repaid the flash loans and kept the borrowed stablecoins, about 1.45M USDC and 584k USDT, leaving 0VIX with bad debt.

Protocol details

Classification Borrowing and Lending / Ecosystem / Oracle Manipulation
Protocol Type Lending
Implementation language Solidity
Protocol links Website @0vixProtocol

Security review history

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Flash Loan Attacks Oracle Manipulation & Price Manipulation

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes