What happened
Tender Finance's GMX price integration returned an incorrectly scaled value, allowing an attacker to treat one GMX token as vastly overvalued collateral and borrow about $1.6 million from the lending market. The security-firm analysis says the funds were returned under a bounty arrangement, but does not provide final recovery accounting.
How it happened
- The GMX price integration returned a 38-decimal price instead of an 18-decimal value.
- The attacker used one GMX as collateral with the inflated valuation.
- The attacker used tETH.borrow to withdraw available assets from the lending market.
Protocol details
Classification
Ecosystem / Oracle Manipulation / Borrowing and Lending
Protocol Type
Lending
Affected asset / contract
TND
Implementation language
Solidity
Protocol links
Website
@tender_fi
Security review history
Funds Recovery
Recovered
$1.5M
Net Loss
$113,600
Evidence
- report @wasgiventhatday incident report twitter.com
- report @tender_fi incident report twitter.com
- report @lookonchain incident report twitter.com
- analysis Website reference cointelegraph.com
- analysis DeFiLlama defillama.com
- analysis Tender Finance Hack Analysis — Improper Oracle Price calculation blog.solidityscan.com
- analysis Tender.fi hacker returns stolen funds, gets bounty reward theblock.co
- analysis Tender.fi dashboard tenderfi.org
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
