Beleaguered DeFi project xToken suffers second major exploit since May

Forum 2 years ago

Beleaguered DeFi project xToken suffers second major exploit since May

The decentralized finance challenge xToken has suffered some other exploit over the weekend after hackers came upon a vulnerability within the good contracts for its xSNX product.

On Aug. 29, the xToken workforce reported that the assault had ended in more or less $4.5 million value of budget being tired from xToken’s xSNX product — which permits customers to realize publicity to Synthetix-based belongings with out without delay interacting with the protocol’s complicated good contracts. 

OUR XSNX CONTRACT WAS ONCE EXPLOITED. OUR DIFFERENT CONTRACTS WOULDN’T HAVE IDENTICAL VULNERABILITIES.

ON A DAILY BASIS GOING AHEAD FROM RIGHT HERE SHALL BE FASCINATED ABOUT REBUILDING CONSIDER WITH OUR NEIGHBORHOOD.

WE ARE ASSESSING THE LOCATION AND CAN REPLACE WITH SUBSEQUENT STEPS WITHIN THE COMING HOURS

— XTOKEN (@XTOKENMARKET) AUGUST 29, 2021

The challenge printed a post mortem a couple of hours later, explaining that the malicious actor had taken out a flash mortgage from the dYdX decentralized trade (DEX) for 25,000 ETH (more or less $81 million) to hold out the assault.

They then used the Ether as collateral to borrow 1.5 million Synthetix governance tokens (SNX) the use of well-liked DeFi cash marketplace protocol Aave, and pooled liquidity token trade, Bancor.

Those had been swapped for six.5 million USDC on decentralized trade, Kyber, exerting downward force on the cost of SNX. The attacker then swapped the USDC for Synthetix’s USD token (sUSD), prior to exploiting a flaw in xToken’s contracts to buy 614,000 SNX at an artificially depressed worth for 811,000 sUSD.

At present costs, the hacker made off with $7 million value of SNX.

In accordance with the newest assault, xToken has introduced it is going to retire the xSNX product, mentioning:

“THE PRESENT XSNX IMPLEMENTATION IS BY MEANS OF SOME DISTANCE OUR MOST INTRICATE PRODUCT, WITH COMPLICATED DEPENDENCIES AND IMPORTANT FLOOR SPACE FOR VULNERABILITIES.”

Comparable: How do DeFi protocols get hacked?

xToken lets in customers to carry interest-bearing derivatives of crypto belongings like AAVE and SNX that require holders to take part in staking, governance, or different protocol interplay with a view to obtain yield.

The incident isn’t the primary time xToken has been exploited this 12 months. In Might, the protocol suffered a identical destiny when a malicious actor manipulated the Kyber DEX whilst additionally concurrently profiting from xToken worth calculations. The breach price the protocol round $25 million in SNX tokens on the time.

Shifting ahead, the xToken workforce mentioned it is going to spend the approaching week running to calculate investor losses and construction a repayment program in response to the use of its local token, XTK. 

On the time of writing, XTK had dumped 45% over the last 24 hours, in line with CoinGecko, and is down greater than 90% from its April all-time top which preceded the primary exploit.