Polter Finance Hack

On November 16, 2024, Polter Finance, a DeFi lending platform on the Fantom network, experienced a severe security breach that led to the loss of around $8.7 million.

The exploit began with the attacker targeting a vulnerability in the price validation logic of the AaveOracle contract, which Polter Finance depended on for price feeds. The key weakness was in the ChainlinkUniV2Adapter, which relied on spot prices without adequate validation. The attacker exploited this weakness by executing a flash loan of 269,042 BOO and 1,154,788 BOO tokens from Spooky V2 and Spooky V3 liquidity pools, significantly reducing the token reserves in those pools and causing an abnormal price spike for the BOO token.

Using this inflated price, the attacker deposited a single BOO token as collateral in Polter's lending pool. Due to the flawed oracle system, the value of this 1 BOO token was calculated at an astronomical $1.37 trillion instead of its true market value. The platform's smart contract failed to detect this discrepancy because the price validation checks within the _fetchPrice and getRoundData functions were inadequate, allowing the manipulated price to go unchallenged.

The attacker repeatedly leveraged the inflated price of the BOO token to borrow wFTM tokens, ultimately draining a total of 9,134,844 wFTM from the lending pools. The price data retrieved by the latestRoundData function failed to account for the rapid changes caused by the flash loan manipulation, lacking necessary safeguards for drastic price swings.

As part of the exploitation, the attacker used flaws in the _getPriceAndTimestamp function, which contained hardcoded values and insufficient price fluctuation checks. These issues enabled the attacker to execute multiple borrowing operations without triggering any validation alarms, leading to the loss of $8.7 million.

In an effort to retrieve the stolen funds, the Polter Finance team has reached out to the attacker via social media channels and filed a police report.