What happened
On August 16, 2024 an attacker drained the WHITE (Whiteheart) supply from Zenterest, a Compound-fork lending market run by MANTRA DAO on Ethereum that had already been closed. The contracts were never paused, and the protocol's ZenterestPriceFeed oracle, which only changes when someone calls updatePrice/updatePriceBatch, had not been updated for about 570 days. The stale oracle still valued MPH (88mph) far above its market price of about $0.47. That let a small amount of MPH collateral borrow every WHITE token in the market. The attacker netted about 4.9 WHITE, around $21,000.
Attack tx: 0xfe8bc757d87e97a5471378c90d390df47e1b29bb9fca918b94acd8ecfaadc598
How it happened
- The attack contract took a Uniswap V3 flash loan of about 85 WHITE.
- It entered the zenMPH market and supplied 23,200 MPH as collateral (2,000 MPH sent directly to
zenMPH, thenmintof 21,200 MPH). - It sent the 85 borrowed WHITE into
zenWHITEand calledaccrueInterest(). Lunaray says this kept the WHITE borrow rate low enough for the borrow to succeed. - The comptroller priced the MPH collateral with the stale
ZenterestPriceFeedvalue, so the attacker couldborrowthe market's entire WHITE balance, about 89.91 WHITE. - It repaid the 85 WHITE flash loan plus fee and kept about 4.9 WHITE.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
