Rodeo Hack

Rodeo Finance, a leveraged yield protocol on Arbitrum, was exploited for about $89,000-$90,000 on July 4, 2023 (UTC), around the time of its public token launch. Security firm BlockSec Phalcon, which flagged the attack the next morning, identified two causes. First, the attacker manipulated the balance of Rodeo's StrategyGamma strategy so that it could borrow small amounts of USDC without its debt increasing. Second, it abused the mintProtocolReserves function, which made an untrusted external call, to withdraw funds from Rodeo's InvestorActor contract.

The attack ran in a single transaction that started with a 150,000 USDC.e flash loan from Balancer and routed funds through the Gamma WETH-USDC vault and Rodeo's lending pool. Phalcon noted that the attacker used an address very similar to Rodeo's deployer, which at first led it to mistake the attacker for the project.

Six days later, on July 11, Rodeo was hit again in a separate and larger attack that manipulated an unshETH price oracle.

**Block data**

• Attacker: 0x20dE06DCF497911aCA02529628383C7599DacfB9
• Attack tx: 0x420cb426b1a297ea8e7618a249c22aea2dde17667338b1eb3aaaed00942837ec