Sentiment Hack

TOTAL LOST $1.0M
Medium Flash Loan Attacks arbitrum

What happened

Quick Summary

Sentiment was exploited through a view re-entrancy Balancer bug, resulting in the loss of 968,279 $USD.

Details of the Exploit

Sentiment is a Borrowing and Lending protocol running on the Arbitrum chain. The attacker used a view re-entrancy Balancer bug to execute malicious code before pool balances were updated and steal money using overpriced collateral. The attack involved several steps:

  1. Attacker took a flashloan.
  2. Attacker significantly changed rates.
  3. Attacker called "exitPool" function and executed hack when balancer sent assets to its contract.
  4. Sentiment contracts were called before PoolBalancesChanged emitted by balancer smart contract.
  5. Hacker could manipulate these values to overprice their collateral and then borrow and withdraw sentiment pool assets.

The exact amount lost due to this exploit reached 968,279 $USD in total, including 538,399 $USDC, 360,000 $USDT, 0.51 $WBTC and 29.97 $WETH.

Block Data Reference

Attacker address:

https://etherscan.io/address/0xdd0cDb4c…2e49C3

Malicious transaction:

https://etherscan.io/tx/0xa9ff2b58…e0f74d

Case & protocol details

Classification Ecosystem / Borrowing and Lending / Reentrancy
Protocol Type Lending
Smart Contract Language Solidity
Official Website www.sentiment.xyz
Protocol Twitter/X @sentimentxyz

Security review history

Funds Recovery

86.3%

Recovered

$863K

Net Loss

$137,000

Post-Incident Timeline

  • 2023-04-05

    The Sentiment Team sent on-chain message, declaring 95,000 $USD bug bounty and 'asking' to return the rest of the funds. The attacker followed the statement, and returned roughly 90% of the stolen amount as 465.75 $ETH. The rest of the funds were transferred through TornadoCash. Returning transactions: https://etherscan.io/tx/0xe1d23500645cc42503235d9f5480c7a1e8b5667248d091df1883c053c7ab7580 https://etherscan.io/tx/0xa9ccdbd14ae7708248f0719d7e985bef7a9fa1084ab38b08a7870c5abec9b6ca https://etherscan.io/tx/0xc84e526fa5f90ee723bc7db2c1c975b7cedc1262f42f4806346f308b6c623e56 On-chain message: https://etherscan.io/tx/0x464c4d204a63c251033791ae631a435be3133301a9675fcd9cc0f6a383d432a1

Evidence & learning

Attack pattern

Compare incidents →
Flash Loan Attacks Reentrancy

Proof of concept

1 available

Sources and on-chain records

Browse all hacks

Other incidents recorded with the same attack technique.

Rari Capital $80.0M
Paraluni Masterchef $1.7M
Grim Finance $40.0M
CREAM Lending $18.8M

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes