$1 Million Exploit on Base Blockchain: A Call for Enhanced Security in DeFi

A significant security breach involving unverified lending contracts on the Base blockchain has led to the theft of approximately $1 million. This incident, reported by blockchain security firm Cyvers Alerts on October 25, unfolded over several hours and has raised concerns within the decentralized finance (DeFi) community.

How the Exploit Occurred

The attacker capitalized on a vulnerability in smart contracts, specifically related to a Wrapped Price manipulation exploit. The initial suspicious transaction extracted a staggering $993,534 from the Base blockchain’s unverified lending contracts. Most of these stolen funds were swiftly moved to the Ethereum network, with around $202,549 deposited into the privacy-focused service Tornado Cash. The same exploit was later used to siphon an additional $455,127.

In a recent Q&A with Cointelegraph, Hakan Unal, Senior SOC Lead at Cyvers Alerts, detailed the weaknesses that facilitated the attack. He noted, “The oracle used by these contracts was not robust, relying only on a single pair with a limited liquidity of approximately $400K, making it susceptible to price swings that could be manipulated.”

This exploit underscores the broader risks associated with DeFi platforms that lack robust security measures. Unal emphasized that using “a more reliable, diversified oracle with higher liquidity to avoid price manipulation” could help prevent similar attacks in the future, especially for assets like WETH.

He further suggested that enhanced due diligence in verifying lending contracts, particularly concerning oracles, can significantly mitigate these risks.

Accountability and Future Considerations

Unal indicated that “the attacker managed to escape” with the stolen funds by exploiting the price manipulation vulnerability. He suggested that accountability may lie with the entity managing the unverified lending contracts and those who chose the insufficiently secure oracle for price verification.

As the identity of the attacker remains unknown, this incident serves as a crucial reminder of the urgent need for DeFi platforms to bolster their security protocols. Improving contract verification and implementing strong security measures is essential to protect user funds and prevent similar breaches in the future.