Base Blockchain Hack: How $1 Million Was Lost

Base Blockchain Hack- Security Flaw Leads to $1 Million Loss on Base Blockchain

Base Blockchain Hack– An exploit involving unverified lending contracts on the Base blockchain has led to the theft of approximately $1 million. This incident, reported by blockchain security firm Cyvers Alerts on October 25, raises significant concerns about the security of decentralized finance (DeFi) platforms.

How the Attack Occurred

The attacker exploited a vulnerability within the smart contracts associated with Wrapped Ether (WETH). By manipulating the price within these contracts, they siphoned off funds over several hours. The initial suspicious transaction netted an impressive $993,534 from Base’s unverified lending contracts. Most of the stolen assets were transferred to the Ethereum network, with $202,549 subsequently deposited into the privacy-centric Tornado Cash service. An additional $455,127 was extracted using the same exploit.

Hakan Unal, Senior SOC Lead at Cyvers Alerts, elaborated on the vulnerability: The oracle used by these contracts was not robust, relying only on a single pair with a limited liquidity of around $400,000, making it susceptible to price swings that could be manipulated.

Security Risks and Recommendations

This incident underscores the broader security risks inherent in DeFi platforms that do not implement robust security measures. Unal emphasized the need for a more reliable, diversified oracle with higher liquidity to avoid price manipulation, especially for assets like WETH. He further suggested that enhanced due diligence for lending contract verification, particularly on oracles used, can mitigate these risks.

The current exploit serves as a wake-up call for DeFi developers to improve their security frameworks and ensure comprehensive contract verification processes.

Accountability and Future Measures

Unal stated that the attacker managed to escape with the stolen funds by exploiting the price manipulation vulnerability. He noted, Responsibility likely falls on the entity managing the unverified lending contracts, as well as those responsible for choosing an insufficiently secure oracle for price verification.

As the attacker remains unidentified, this incident highlights a critical need for DeFi platforms to bolster their security protocols to protect user funds and prevent similar breaches in the future. Ensuring thorough contract verification and robust oracle systems will be essential in mitigating risks and enhancing the overall integrity of decentralized finance.

FAQs