Inverse Finance Case: Another $1.2M loss due to Flash Loan
Inverse Finance Case: Another $1.2M loss due to Flash Loan
Inverse Finance - a decentralized platform for lending, borrowing and creating synthetic assets, has recently suffered another flash loan vulnerability attack, which resulted in a loss of $1.2M.
What is Flash Loan?
Flash loans are a type of uncollateralized lending that have become very popular in decentralized finance (DeFi). Unlike normal loans, flash loans do not require a borrower to provide typical requirements such as proof of income, reserves, or collateral.
Like traditional loans, flash loans operate on a similar framework in which the borrowed amount is expected to be paid back in full eventually, with interest. However, flash loans also have some unique terms and premises:
- Use of Smart Contracts: In flash loans, the smart contract rules ensure that the borrower pays back the loan before the transaction ends. If this condition isn’t met, the smart contract reverses the transaction.
- Unsecured loans: no collateral is needed when using flash loan
- Instantaneous transactions: a flash loan is expedited in an instant, which means that the loan’s smart contract must be fulfilled during the transaction for which it’s lent out
Take a deep look in Inverse Finance flash loan attack
Exploiters seemed to use a flash loan attack on Inverse Finance to trick the protocol and steal more than 53 Bitcoin, worth $1.1M and 100,000 Tether (USDT) - a stablecoin backed on a 1-1 basis with U.S. dollars.
To be specific, in order to launch the attack, the hackers used price oracle manipulation, which misuses the balances of assets in the pool to directly calculate the LP token price.
With this manipulation, the hackers took advantage of AAVE’s flash loan in Curve Finance (CRV) and borrowed Inverse Finance's assets, DOLA, at extremely low rates. Next, DOLA was converted to USDT to pay off the initial loan.
Here are some key activities of the hackers:
Noticeably, Inverse Finance was also exploited for $15.6M 2 months ago because the attackers artificially manipulated collateralized token prices through a price oracle to drain funds using the inflated prices.
Prevention of flash loans attacks
Flash loans are generally used by traders, but bad actors may use flash loans to trick a protocol’s smart contract into manipulating prices on liquidity pools and take over that pool’s assets. As a smart investor, you must know to protect yourself from anticipated risk of flash loan attack. Here are some ways 1Shield suggested:
- Use a decentralized lending platform: These platforms are less likely to be attacked as they don’t hold user assets
- Always stay alert and informed: One of the best ways to avoid flash loan attacks is to update regularly about the latest developments in the DeFi space
- Don’t put all your eggs in one basket: Divide your assets reasonably so that you’re not reliant on anyone’s platform or protocol
About 1Shield
1Shield provides Audit & KYC services to help build trust in the Blockchain industry. With expertise in formal verification and fast audit process, 1Shield ensures your project will get invaluable credibility.
Website | Twitter | Blog | Telegram Channel