DeFi platform Opyn loses $371,000 in hack

Hackers siphoned about $371,000 of user funds from the DeFi platform Opyn, exploiting the vulnerability in the project’s internal token, oTokens.

Here is an overview of the incident affecting ETH Put contracts. No other contracts are affected. ~371k USDC was lost. We worked with @samczsun to whitehack, securing ~439k USDC. Affected users, please see below. Full post-mortem coming in next few days.https://t.co/ILNutAiqfU

— opyn (@opyn_) August 4, 2020

The attackers carried out a double-spend attack on ETH put options, gaining access to collateral belonging to users who sold the contracts.

To prevent further losses, Opyn withdrew 572 165 USDC from its own smart contract and also disabled the ability to purchase oTokens.

The Opyn options protocol is fully decentralised, therefore the project leadership cannot control or temporarily disable it in the event of an attack.

The company proposed buying back the victims’ oTokens at a 20% premium to compensate for losses. The question of compensating users without tokens is being considered.

Opyn pledged to bolster the protocol’s security and to increase rewards for external developers for identifying vulnerabilities. The leadership will also conduct additional audits of the reliability of the smart contracts.

Earlier in February, attackers conducted two consecutive successful attacks on the DeFi protocol bzx. The losses amounted to $350,000 and $645,000, respectively. In April, a hacker withdrew $25 million from the dForce project’s ecosystem, after which the funds were returned in full.

Follow ForkLog news on Facebook!