Incident Overview
Sentiment was exploited through a view re-entrancy Balancer bug, resulting in the loss of 968,279 $USD.
Sentiment is a Borrowing and Lending protocol running on the Arbitrum chain. The attacker used a view re-entrancy Balancer bug to execute malicious code before pool balances were updated and steal money using overpriced collateral. The attack involved several steps:
1. Attacker took a flashloan.
2. Attacker significantly changed rates.
3. Attacker called "exitPool" function and executed hack when balancer sent assets to its contract.
4. Sentiment contracts were called before PoolBalancesChanged emitted by balancer smart contract.
5. Hacker could manipulate these values to overprice their collateral and then borrow and withdraw sentiment pool assets.
The exact amount lost due to this exploit reached 968,279 $USD in total, including 538,399 $USDC, 360,000 $USDT, 0.51 $WBTC and 29.97 $WETH.
Attacker address:
https://etherscan.io/address/0xdd0cDb4c…2e49C3
Malicious transaction:
https://etherscan.io/tx/0xa9ff2b58…e0f74d
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Sentiment, these are the critical security checks that could have prevented this incident (April 2023).
- Verify all logic paths related to Flashloan Reentrancy Attack / Reentrancy are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Check that all state-changing functions follow the Checks-Effects-Interactions (CEI) pattern to prevent reentrancy and logic ordering bugs
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialFunds Recovery
Recovered
$863K
Net Loss
137000
Post-Incident Timeline
-
2023-04-05
The Sentiment Team sent on-chain message, declaring 95,000 $USD bug bounty and 'asking' to return the rest of the funds. The attacker followed the statement, and returned roughly 90% of the stolen amount as 465.75 $ETH. The rest of the funds were transferred through TornadoCash. Returning transactions: https://etherscan.io/tx/0xe1d23500645cc42503235d9f5480c7a1e8b5667248d091df1883c053c7ab7580 https://etherscan.io/tx/0xa9ccdbd14ae7708248f0719d7e985bef7a9fa1084ab38b08a7870c5abec9b6ca https://etherscan.io/tx/0xc84e526fa5f90ee723bc7db2c1c975b7cedc1262f42f4806346f308b6c623e56 On-chain message: https://etherscan.io/tx/0x464c4d204a63c251033791ae631a435be3133301a9675fcd9cc0f6a383d432a1
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Proof-of-Concept Exploits
On-Chain Evidence & References
- Twitter/X Alert https://twitter.com/peckshield/status/1643417467879059456
- Twitter/X Alert https://twitter.com/spreekaway/status/1643313471180644360
- Post-Mortem https://medium.com/coinmonks/theoretical-practical-balancer-and-…
Sources & References
Learn to Prevent the Next Sentiment
The Sentiment hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.