Ola Finance Exploited for $3.6M in Re-Entrancy Attack

The attack targeted Fuse Lending, which is an implementation of Ola Finance on the EVM-compatible Fuse blockchain.

AccessTimeIconMar 31, 2022 at 3:56 p.m. UTC
Updated Apr 2, 2022 at 12:41 a.m. UTC

Sam is a reporter at CoinDesk focused on decentralized technology, DeFi and DAOs. He owns ETH, BTC and MATIC.

Ola Finance disclosed Thursday that it has suffered an exploit that allowed an attacker to grab $3.6 million worth of crypto. The attack targeted Fuse Lending, which attempted to use Ola’s lending-as-a-service protocol with incompatible token standards.

According to PeckShield, a blockchain security firm that worked with Ola to diagnose the exploit, the attacker took advantage of a so-called “re-entrancy” bug in one of Ola’s smart contracts.

The attack comes after this week’s disclosure of a $625 million exploit of Axie Infinity’s Ronin network – one of the largest in decentralized finance (DeFi) history. While much smaller in comparison, the Ola attack stands as a reminder of how multimillion-dollar thefts – now commonplace in DeFi – continue to pile up as big money flows into lesser-known ecosystems.

Ola’s DeFi protocol operates across several blockchains, and Thursday’s attack targeted its deployment on the Fuse network – an Ethereum Virtual Machine-compatible blockchain with a mere $12.8 million in total value locked (TVL) prior to the attack, according to data compiled by DefiLlama.

The attacker began by withdrawing funds using Tornado Cash, which enables users to transfer crypto without leaving a trace. After transferring the funds to the Fuse network, the borrower used them as collateral to take out loans on Ola’s decentralized lending platform. Taking advantage of the re-entrancy bug, the attacker was then able to remove the collateral without first paying back the loan.

The hacker repeated this process several times across different Ola pools. They then transferred the drained funds to wallets on Ethereum and BNB Chain.

Ola has paused the use of its lending protocol on Fuse network and tweeted that it will soon publish an “official report detailing the exploit.” The project says its services on other blockchains were unaffected by the exploit and will remain operational.

This is not the first, nor the largest re-entrancy attack in recent memory.

Little more than two weeks before the Ola attack, two lending protocols on the Gnosis blockchain suffered similar exploits. The DAO attack in 2016, an infamous exploit that led to an Ethereum hard fork, was also a version of a re-entrancy attack.

UPDATE (April 2, 0:41 UTC): Adds information to clarify the relationship between Fuse Lending and Ola Finance.


Read more about

DISCLOSURE

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.

CoinDesk - Unknown

Sam is a reporter at CoinDesk focused on decentralized technology, DeFi and DAOs. He owns ETH, BTC and MATIC.

CoinDesk - Unknown

Sam is a reporter at CoinDesk focused on decentralized technology, DeFi and DAOs. He owns ETH, BTC and MATIC.