Hundred Finance Hit by $7.4M Flash Loan Attack on Optimism: Another Blow to DeFi Security?

In the fast-paced world of decentralized finance (DeFi), security remains a paramount concern. Just when you thought things were getting safer, another protocol falls victim to a sophisticated exploit. This time, it’s Hundred Finance, a multichain lending platform, that has announced a significant security breach on Ethereum‘s Layer-2 scaling solution, Optimism. The damage? A staggering $7.4 million.

What Exactly Happened to Hundred Finance?

On April 15th, the team at Hundred Finance took to Twitter to break the news. They confirmed a security compromise and stated they were already in contact with the attacker while collaborating with leading security experts to address the situation. While the initial announcement was brief, blockchain security firm CertiK quickly stepped in to shed light on the nature of the attack: a flash loan exploit.

Let’s break down what this means. Imagine someone borrowing a huge sum of money without putting up any collateral. Sounds risky, right? In DeFi, this is possible through something called a ‘flash loan’. These loans are executed and repaid within the same blockchain transaction. If not handled carefully, they can be a powerful tool for malicious actors.

Flash Loan Attacks Explained

• Instant Borrowing Power: Flash loans allow anyone to borrow massive amounts of cryptocurrency without upfront collateral.
• Single Transaction Execution: The borrowing, manipulation, and repayment all happen within a single, lightning-fast blockchain transaction.
• Exploiting Market Inefficiencies: Attackers use this borrowed capital to manipulate prices on decentralized exchanges (DEXs) or lending platforms.
• Profit & Repay: By carefully orchestrating these manipulations, attackers can profit from price discrepancies and repay the flash loan in the same transaction, leaving with a hefty gain – and the protocol with significant losses.

Think of it like this: a thief borrows a truckload of money, uses it to briefly inflate the price of apples at a market, sells their apples at the inflated price, pockets the profit, returns the truckload of money, and leaves before anyone notices the price manipulation was artificial. Except, in DeFi, this all happens in seconds, automatically, and on the blockchain.

How Did the Flash Loan Attack Unfold on Hundred Finance?

CertiK provided a more detailed explanation of the attack on Hundred Finance. The core issue revolved around the manipulation of the exchange rate between ERC-20 tokens and hTOKENS, which are interest-bearing tokens representing deposited assets on Hundred Finance. Essentially, hTOKENS represent your share of the assets within the lending pool.

Here’s a simplified breakdown of the exploit:

1. Exchange Rate Manipulation: The attacker cleverly manipulated the “Cash value” within the hBTC contract. “Cash value” in this context refers to the amount of the underlying asset (in this case, WBTC – Wrapped Bitcoin) held by the hToken contract.
2. Inflating WBTC Supply: By injecting massive amounts of WBTC into the hToken contract, the attacker artificially skewed the exchange rate. This made it appear as though each hTOKEN was worth significantly more WBTC than it actually was.
3. Profiting from the Skewed Rate: With this inflated exchange rate in place, the attacker could withdraw a much larger quantity of tokens (more WBTC than they initially deposited or were entitled to) when redeeming their hTOKENS.
4. Flash Loan Power: This manipulation was likely powered by a flash loan, providing the attacker with the necessary capital to inject the large sums of WBTC and execute the attack swiftly.

In essence, the attacker exploited a flaw in the exchange rate calculation mechanism within Hundred Finance’s smart contracts, leveraging a flash loan to amplify their gains.

Deja Vu? Hundred Finance’s History with Security Breaches

This recent incident on Optimism isn’t Hundred Finance’s first brush with security vulnerabilities. Over a year ago, the protocol suffered another exploit on the Gnosis Chain. In that instance, a reentrancy attack was used to drain liquidity, resulting in losses of nearly $6 million. Interestingly, the same attacker also targeted Agave, another protocol, using the same reentrancy technique.

This history raises serious questions about the overall security posture of Hundred Finance and the recurring nature of vulnerabilities. While DeFi is inherently experimental and rapidly evolving, repeated exploits highlight the critical need for robust security audits, rigorous testing, and continuous monitoring.

The Bigger Picture: DeFi and the Persistent Threat of Flash Loan Attacks

Unfortunately, Hundred Finance is not alone. The DeFi landscape has witnessed a series of high-profile flash loan attacks. Recent examples include:

• Euler Finance ($196 million): A massive flash loan attack in March 2023 shook the DeFi community, resulting in one of the largest exploits to date. Interestingly, in a rare turn of events, the hacker eventually returned a significant portion of the stolen funds.
• Mango Markets ($46 million): In October 2022, Mango Markets on Solana was targeted by a flash loan attack. In this case, law enforcement took action, and the alleged attacker was apprehended in the US.

These incidents, alongside the Hundred Finance exploit, underscore the ongoing challenges in securing DeFi protocols. Flash loan attacks, in particular, have become a favored method for malicious actors due to their speed, complexity, and potential for significant financial gain.

What Can Be Learned from the Hundred Finance Exploit?

The Hundred Finance attack, like many DeFi exploits, serves as a stark reminder of the inherent risks within this burgeoning space. While DeFi offers exciting opportunities for financial innovation and accessibility, security cannot be an afterthought. Key takeaways include:

• Smart Contract Audits are Crucial: Thorough and independent audits are essential to identify potential vulnerabilities before they can be exploited. However, even audited protocols can still be vulnerable, highlighting the need for continuous security monitoring and proactive risk management.
• Robust Exchange Rate Mechanisms: DeFi protocols, especially lending platforms, must implement robust and resilient mechanisms for calculating exchange rates to prevent manipulation. This includes careful consideration of potential attack vectors and rigorous testing under various stress scenarios.
• Importance of Incident Response: Hundred Finance’s quick response in acknowledging the attack and engaging with security experts is commendable. A swift and transparent incident response plan is critical to mitigate damage, communicate with users, and work towards recovery.
• User Awareness and Due Diligence: Users also have a role to play in DeFi security. Understanding the risks associated with different protocols, diversifying holdings, and exercising caution when interacting with new or unaudited platforms are vital steps.

Conclusion: Navigating the Complexities of DeFi Security

The $7.4 million flash loan attack on Hundred Finance is yet another wake-up call for the DeFi community. It underscores the persistent and evolving nature of security threats in this space. While innovation in DeFi continues at breakneck speed, security must remain a top priority. Protocols need to invest in comprehensive security measures, and users need to stay informed and vigilant. The future of DeFi hinges on building trust, and trust is fundamentally built on security. As the post-mortem report from Hundred Finance emerges, the community will undoubtedly be looking for insights and actionable steps to prevent similar incidents and fortify the foundations of decentralized finance.