Rari Fuse Hack

Seven of Rari's Fuse pools were drained due to re-entrancy attack. The total amount of losses is ~$80m.

Rari enables the creation of so-called Fuse Pools permissionless lending pools that anyone with a wallet can access from anywhere to lend or borrow ERC-20 tokens.

The attack drained Rari's pools while Rairy's pools were unaffected. Fei Rari uses a fork of the Compound code that doesn't follow the check-effect-interaction pattern which the attacker took advantage making a re-entrancy attack via CEther which uses call.value to send ETH.

Attack flow:

1. Attacker flash loaned 150m USDC and 50k WETH
2. Deposited 150m USDC as collateral into fUSDC-127 contract for loans. This contract is a fork of vulnerable smart-contract of Compound protocol.
3. The attacker borrows 1,977 ETH via borrow() function
4. As the borrow() function does not follow the check-effect-interaction pattern and transfers ETH to the attacker’s contract before updating the attacker’s borrow records.
5. As the attacker’s borrow record not updated, the attacker made a re-entrant call to exitmarket() that allows the attacker to withdraw his collateral.

The attacker repeated the following actions, repaid the flash loan, and kept the remaining profit for himself.

Funds lost:

ETH - 6 037.81

FEI - 20 251 603.11

DAI - 14 278 990.68

LUSD - 1 948 952.18

USDC - 10 055 556.33

USDT - 132 959.90

RAI - 31 615.87

FRAX - 13 101 364.94

UST - 2 765 891

Total lost in USD: 79 749 026$

Update 22.09.2022:

Tribe DAO which is a conglomerate of Midas Capital, Rari Capital, Fei Protocol and Volt Protocol has passed an on-chain vote with 99% consent to fully reimburse the $80m in losses victims suffered in the Rari capital exploit.

Attacker Address: https://etherscan.io/address/0x6162759e…66157F

Attack transactions:

ETH: https://etherscan.io/tx/0xab486012…e76530

Arbitrum: https://arbiscan.io/tx/0x3212d091…3203ef

Attacker contracts:

1. Address
2. Address