Onyx Protocol Hack Analysis

Onyx Protocol Hack Analysis

Overview:

On November 1 , 2023, Onyx Protocol suffered an attack due to precision loss vulnerability, leading to an approximate loss of ~2M USD.

Smart Contract Hack Overview:

• Attacker address:0x085bdf
• Attack Contract:0x526e8e
• Vulnerable Contract: 0x5fdbcd
• Attack Transaction: 0xf7c216

Decoding the Smart Contract Vulnerability:

• The Oynx Protocol encountered a security breach, primarily caused by a “precision loss vulnerability.”The attack was concentrated on the oPEPE market, which had been established through proposal 22.
• To execute the attack, the perpetrator engaged in a multi-step process that included minting small shares and making substantial PEPE donations to manipulate the market’s exchange rate.
• In addition to these actions, the attacker borrowed Ether, adding complexity to their exploit.
• The attack concluded with the attacker successfully retrieving all the PEPE tokens due to the presence of a precision loss bug within the redeemUnderlying function.

Mitigation and Best Practices:

• Multiplication should always be performed before division to avoid loss of precision.
• The calculated result for division and multiplication can be stored in an integer with more bits, but the operands must also be integers of the same size.
• Always validate your code by writing comprehensive test cases that cover all the possible business logic.
• To prevent such vulnerabilities, the best Smart Contract auditors must examine the Smart Contracts for logical issues. We at CredShields provide smart contract security and end-to-end security of web applications and externally exposed networks. Schedule a call at https://credshields.com/
• Scan your Solidity contracts against the latest common security vulnerabilities with 130+ detections at SolidityScan

Conclusion:

SolidityScan is an advanced smart contract scanning tool that discovers vulnerabilities and reduces risks in code. Request a security audit with us, and we will help you secure your smart contracts. Signup for a free trial at https://solidityscan.com/signup

Follow us on our Social Media for Web3 security-related updates.
SolidityScan — LinkedIn | Twitter | Telegram | Discord