WOOFi Reviews $8.75 Million Loss, Presents 10% Bounty for Return

WOOFi, a decentralized finance platform, skilled an exploit on March fifth that focused its swap characteristic on the Arbitrum community. The occasion resulted in a lack of roughly $8.75 million in crypto property.

The platform stated it has initiated efforts to get well these funds and has supplied a ten% whitehat bounty to the exploiter. Moreover, a bounty has been positioned on Arkham Intelligence for anybody offering extra info.

WOOFi’s Exploit

In keeping with the autopsy report, the sPMM algorithm governing pricing on WOOFi Swaps was exploited on Arbitrum. The assault concerned a sequence of flash loans leveraging low liquidity to govern the worth of WOO, permitting the exploiter to repay the loans at a diminished value.

The exploiter borrowed round 7.7 million WOO and different property, promoting the tokens on WOOFi. This motion brought about WOOFi’s sPMM to inaccurately alter WOO to a particularly low worth, enabling the exploiter to swap out 10 million WOO in the identical transaction practically cost-free.

The exploiter repeated this assault 3 times inside a quick interval, leading to income of roughly $8.75 million after repaying the flash loans.

WOOFi revealed that the sPMM in its second model is designed to supersede oracle costs by contemplating customers’ commerce notional values to manage slippage and uphold pool equilibrium.

Nevertheless, a glitch led to an intensive deviation from the anticipated vary ($0.00000009), and the fallback verify, usually executed towards Chainlink, didn’t embody the WOO token worth.

Conservative Itemizing Technique Pays Off

WOOFi additionally stated that its sPMM had been incident-free since its introduction again in 2021, primarily due to the “conservative strategy” to itemizing new property. The platform’s stringent itemizing course of made initiating an exploit with main property like ETH practically not possible.

Nevertheless, it blamed the current introduction of a lending marketplace for WOO on Arbitrum, coupled with comparatively restricted liquidity help for WOO tokens elsewhere on the community, which rendered the exploit economically viable.

Whereas WOOFi Swap is operational throughout greater than ten networks, none apart from Arbitrum featured each the WOO token and a WOO lending market, successfully thwarting the replication of the identical exploit on alternate networks.

In the meantime, a current report by CertiK stated the crypto sector suffered losses of round $160 million in February as a result of exploits, hacks, and scams. These numbers mirrored a minor lower in comparison with January regardless of an uptick in costs. Amongst these losses, flash loans accounted for less than $138,000.